Scan report · 2 months agoPublic

marmiorobicl.it

132.243.255.96AS26383 · CY

Submittedhttps://marmiorobicl.it/

device-code phishing (Microsoft) on non-legit host

Engine tags

Verdict

2 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 1.2 s · 1 requests

01 · Visitor opensmarmiorobicl.it

02 · Page shown

Join Teams Meetingstyled as Microsoft · low

03 · OutcomeToken theft — MFA includedThe code authorises the attacker's own sign-in at the real provider. Tokens are taken, not passwords.

Dangerous — confirmed threat

Automated

Its page title claims to be Microsoft, which this address is not associated with. It shows a sign-in code and sends you to the real Microsoft login page — a technique used to take over an account without ever seeing your password. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

Token theftDevice-code phishing (OAuth device-grant abuse)

Entering this trap's code at the real Microsoft device-login screen authorizes an attacker's session — MFA included. Sign-in tokens are stolen, not passwords, so no credential form ever has to appear — which is why this slips normal phishing checks.

Microsoft · Microsoft device-login ref: microsoft.com/device (via anchor); on non-legit host marmiorobicl.it; code "GVWG8LVSD"; device-code instructions present

The page shows a sign-in code and steers you to the REAL Microsoft device-login page to enter it. Doing so authorizes the attacker's own session — including your MFA — without ever asking for your password. That is why there is no login form on this page.

Analyst noteDefinitive: a device-login code + a link to the real provider on a non-legit host = device-code (device-authorization-grant) phishing. It bypasses MFA and steals tokens, not passwords. Treat as malicious; the impersonated provider is the takedown/abuse target.

InfoBrand impersonation detected

Microsoft · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Downloaded fileCleanThe engine stored it under a generated name

SHA-25625ee6aa7b40b7975719bd88118be8648302b48b0f2518a00f9a5e69c5bea438b

Infrastructure

IP: 132.243.255.96ASNET - Baxet Group Inc., US · AS26383CY
TLS: CN=YR2, O=Let's Encrypt, C=US · expires Oct 3, 2026

16 malicious6 suspicious

Hashes & fingerprints

Page Hashce4e2a729eb040e72d0f9c5a705a1a1c26b35231bee31177c45e04c8f7ce992b Favicon Hashd4ba04ba16c3dc601fb80a44b37b8c1345bd0db7fb8779cc7ba9861a1e38b807 DOM Hashb192a94b06cba61eb638d0a769ff101582e44a64bb1c71a18225f7a38b1b9a3e Screenshot pHashbc22c7983c67c399 JARM15d3fd16d29d29d00042d43d000000fe02290512647416dcf0a400ccbc0b6b JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint13C9CCDDC646A07D090B2D6E338C7D5C5A38E110 Cert IssuerCN=YR2, O=Let's Encrypt, C=US

Page capture

Live

Title “Join Teams Meeting” · brand shown: Microsoft (low)

Visit Site

Engines

7 · time to verdict