zos8u1fw4t.fultonhogans.com.au
188.114.96.0AS13335 · USAn interaction gate (e.g. Cloudflare Turnstile) blocked full analysis, but a detection rule identified this page anyway. The pre-gate score below rates only what was visible before the gate — not the evidence this verdict rests on.
the verification control on this page opens onto https://zos8u1fw4t.fulto…1751f57c3a23e357cbd5b6, which runs a Microsoft device-code sign-in flow, and it was read past an anti-bot gate on a throwaway copy
- Browser Analysismalicious
- Threat Intelligenceclean
- Network & Hostingclean
- Content Inspectionunknown
- TLS Fingerprintunknown
- Domain Intelligenceunknown
What happened
Step by step, from what the scanner recorded.Dangerous — confirmed threat
Preliminary / could not fully loadIts verification check opens onto a page that shows a sign-in code and sends you to the real Microsoft login page — a technique used to take over an account without ever seeing your password. It shows a bot-check screen that it draws itself — it copies a protection provider's wording but never contacts that provider. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.
What to do
Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.
This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.
Findings
Strongest firstEntering this trap's code at the real Microsoft device-login screen authorizes an attacker's session — MFA included. Sign-in tokens are stolen, not passwords, so no credential form ever has to appear — which is why this slips normal phishing checks.
The gate carries no branding itself, which is expected — the Microsoft costume is on the page it opens, one step past the verification click, where the code is asked for.
Device code on the page the gate opened
FU2TB8ZH9
Session-specific: the trap mints a fresh code for every visitor. This one was live for our scanner — a victim gets a different string, so read it as evidence of the flow, not as an identifier to hunt on.
The verification control on this page leads to https://zos8u1fw4t.fultonhogans.com.au/l/ySCWc9WN1W8?key=901751f57c3a23e357cbd5b6, which we opened and analysed: it runs a Microsoft device-code sign-in flow. The visitor is shown a code and sent to the REAL Microsoft sign-in page to enter it, so what they approve is the attacker's session — including the multi-factor step — without a password ever being typed. That is why there is no login form to find here. That page is dressed as Microsoft, which this one is not — the gate carries no brand of its own, so the impersonation only becomes visible one document further on. Evidence: Microsoft device-login ref: login.microsoftonline.com/common/oauth2/deviceauth (via frame-inline-script-sink); on non-legit host zos8u1fw4t.fultonhogans.com.au; code "FU2TB8ZH9"; device-code instructions present.
Analyst noteThe address above is where the code is displayed and the provider beside it is the takedown and abuse target. The code quoted here is the one OUR session was shown: this kit mints a fresh one per visitor, so it identifies the attacker's pending sign-in at the time of the scan, not the one any victim saw. Tokens are stolen rather than passwords, so an affected user's sessions have to be revoked — a password reset alone does not end the access.
A bot-protection challenge (e.g. Cloudflare Turnstile) blocked full analysis, so the verdict relies on pre-gate evidence (see the Gated Risk Assessment).
Analyst noteThe gate alone is NOT suspicious — many legitimate sites use it. Read the Gated Risk Assessment for the actual pre-gate risk.
File
The file was not analysed, so the scan carries no verdict on the file itself.
Gated Risk Assessment
This page sits behind a bot-protection gate, but it was already identified by a detection rule — see the verdict reason for what fired. The score below reflects ONLY the weak pre-gate signals (score 0) and does not override that finding.
Pre-gate signals
No pre-gate risk signals detected.
Path to gate (1 hops)
Infrastructure
- IP
- 188.114.96.0CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
- TLS
- CN=YE2, O=Let's Encrypt, C=US · expires Dec 16, 2026
Hashes & fingerprints
Page capture
LiveTitle “Bloom”
Engines
6 · time to verdictPage
- HTTP
- 200 · AntiBotChallenged
- Title
- Bloom
- Load
- 25.45 s · 1 requests