m365003573-shared-live-document-review-sign.live-shared-m365039.workers.dev
188.114.97.1AS13335 · USdevice-code phishing (Microsoft) on non-legit host
- Browser Analysismalicious
- Content Inspectionsuspicious
- Threat Intelligenceclean
- Network & Hostingclean
- Related Infrastructureclean
- Domain Intelligenceunknown
- TLS Fingerprintunknown
- Lexical Url Heuristicunknown
What happened
Step by step, from what the scanner recorded.Dangerous — confirmed threat
AutomatedIts page title claims to be Microsoft, which this address is not associated with. It shows a sign-in code and sends you to the real Microsoft login page — a technique used to take over an account without ever seeing your password. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.
What to do
Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.
This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.
Findings
Strongest firstOur Content Inspection engine downloaded the file this URL serves and analyzed it. The payload shows traits commonly seen in malware. Treat it as unsafe until verified.
Success
SHA-256 53dde8a3138f3fb73b53ba44a44694e1eb2ad5066dba803cb17974cb969c1183
Entering this trap's code at the real Microsoft device-login screen authorizes an attacker's session — MFA included. Sign-in tokens are stolen, not passwords, so no credential form ever has to appear — which is why this slips normal phishing checks.
Microsoft · Microsoft device-login ref: microsoft.com/devicelogin (via inline-script-sink); on non-legit host m365003573-shared-live-document-review-sign.live-shared-m365039.workers.dev; device-code instructions present
The page shows a sign-in code and steers you to the REAL Microsoft device-login page to enter it. Doing so authorizes the attacker's own session — including your MFA — without ever asking for your password. That is why there is no login form on this page.
Analyst noteDefinitive: a device-login code + a link to the real provider on a non-legit host = device-code (device-authorization-grant) phishing. It bypasses MFA and steals tokens, not passwords. Treat as malicious; the impersonated provider is the takedown/abuse target.
The page assembled its next screen in memory and navigated to it as a blob: document. Nothing was fetched, so the page you would see never crossed the network — and it claims a brand this host does not own.
Analyst noteThere is no second URL to submit anywhere: a blob URL lives only in the tab that made it. Pivot on THIS host, on the script that builds the document, and on any external script it pulls into the blob — that host is usually the kit, and it is configuration, so expect it to rotate.
The page presents itself as a known brand (brand keywords/branding detected).
Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.
Infrastructure
- IP
- 188.114.97.1CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
- TLS
- CN=WE1, O=Google Trust Services, C=US · expires Nov 30, 2026
Hashes & fingerprints
Page capture
LiveTitle “OneDrive — Sign in to continue” · brand shown: Microsoft (medium)
Engines
8 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- OneDrive — Sign in to continue
- Load
- 1.68 s · 2 requests