Security Scan Report: puselili.z20.web.core.windows.net

Redirected to:
https://puselili.z20.web.core.windows.net/ctgdctopacg/index.html?phone...
Site favicon
Submitted: Completed: publiccompleted
This website contacted 3 IPs in 1 country across 2 domains to perform 29 HTTP transactions. The main domain is windows.net and was registered 31 years ago.

Submitted URL: https://puselili.z20.web.core.windows.net/?phone=050-3095-4311

Effective URL:
https://puselili.z20.web.core.windows.net/ctgdctopacg/index.html?phone...
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Fake Microsoft Windows Defender alert demanding victims call 050-3095-4311 to 'remove malware' — a confirmed tech-support scam flagged by Safe Browsing. Do not interact.

Risk Factors (7)
Brand impersonation of Microsoft Windows Defender on a non-Microsoft domain
Fabricated malware/Defender scan alerts designed to induce panic
Phone-number call-to-action used to harvest victims for remote-access fraud
Coercive claims that closing the window will expose personal data or suspend the license
Azure blob storage hosting with unknown/instant subdomain creation
IDS alert: ET INFO External IP Lookup Domain in DNS Lookup (ipwho.is) used to geolocate the victim
Classifier flagged 'phishing scam' category at 100% confidence
Domain age information unavailable

Details

Page Title

読み込みエラー

Scan Type

public

Domain Name Analysis

The domain 'puselili.z20.web.core.windows.net' uses the network infrastructure generic top-level domain (.net); it also runs on subdomain 'puselili.z20.web.core'. The core label 'windows' covers 7 characters split between two vowels and five consonants. Splitting it apart reveals one word: windows. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://puselili.z20.web.core.windows.net/?phone=050-3095-4311

Page Load Overview

4.42s
Total Load Time
549 KB
Total Size

Language Analysis

Primary Language

🇯🇵Japanese
Code: ja
Confidence:60%
Script:Mixed
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:1,427 chars
Detector Agreement:100%
Language mismatch: Declared as en but detected as ja

Website Classification

Primary Category

documentation technical100% confidence
Type: spa
Method: ml+structural

All Detected Categories

documentation technical
100%
phishing scam
100%
government public service
100%
blog personal website
100%
education learning
100%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1120.209.91.40Azure · CLOUDBoydton, Virginia, United States
AS8075Microsoft Corporation
9172.66.175.107Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
9104.20.44.133Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
293--

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1BE03821CE9F19162444340756FA37A8A3F048A07E516A90C7BEC83F65F93E69CC47BAD

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:ydSTr1S6OkboenxvwcxX/WR3NMz6v8NwF+2jK6iFIseiHoW2jkuwBr3P:xArpexvw2Wj3v8n

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:38883:JYTJUwSQFopECRgCDgAQQAiIWwUGCUQECBqBaAmAEygZoSBSMB3YrHAeUkEA1ZgYKIVKGGEBi0oAkaYIoB0AiQg4UASg4MAQ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff00000000ffffff
Perceptual Hash:8f0db8e0e3de9630
Difference Hash:70f27870d37c2b61
Wavelet Hash:ff00000000ffffff
Color Hash:#2d8649

Scan History

Scan history not available

Unable to load historical scan data