Security Scan Report: url6446.matcotools.com

Redirected to:
https://msftportallogin.com/[email protected]
Submitted: Completed: publiccompleted
This website contacted 3 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main domain is matcotools.com and was registered 30 years ago.

Submitted URL: http://url6446.matcotools.com/ls/click?upn=u001.TCfY-2FRCPOOCeM8DObG-2FU8sp561S8Jg-2BP5QiRAZ5T8idXJ6bCij47-2FrV9Y0n2v5dV-2BXD2zgD-2F4umpyM-2B-2Fjt3JdQ-3D-3DbTkV_OLjSJnqHm8m7-2F-2F56DWnfZJlgeeOxWA0YdMHg-2Bqvd4FnCo0UUQShQ5NiOBCgsW0KxYPxTv1S2fmI6xcn8juyN3Wx49yyxZWbP6C0L-2FB3H8P7BSOLjE3RBO-2FK7WEQBIaTOc84NrDeaVIPKp6u-2F6lvKwhP8RnqZY3OPG5ALPqjE-2BDRa5diJf54oDAvtHe4P96HddXZZtTZvZDsqEmWux3mtZw-3D-3D

Effective URL:
https://msftportallogin.com/[email protected]
Redirected

The Cisco Umbrella rank of the primary domain is #293,206 of the top 1 million websites

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Fake Microsoft one-time-code portal on the lookalike domain msftportallogin.com, designed to harvest an authentication code sent to a victim's email. Brand impersonation plus OTP capture; avoid interaction.

Risk Factors (5)
Brand impersonation of Microsoft on an unofficial domain
Deceptive lookalike hostname 'msftportallogin.com'
One-time-code / authentication-code capture page
Redirect-based delivery from a third-party click-tracking URL
Newly registered domain (≤1 day old)
Domain age information unavailable

Details

Page Title

Enter your code

Scan Type

public

Domain Name Analysis

The domain name 'url6446.matcotools.com' uses the commercial generic top-level domain (.com) with subdomain 'url6446'. Its registrable label 'matcotools' stretches across 10 characters with 4 vowels and 6 consonants. Tokenizing the label suggests three words: mat, co, tools. Median word length comes out to 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of http://url6446.matcotools.com/ls/click?upn=u001.TCfY-2FRCPOOCeM8DObG-2FU8sp561S8Jg-2BP5QiRAZ5T8idXJ6bCij47-2FrV9Y0n2v5dV-2BXD2zgD-2F4umpyM-2B-2Fjt3JdQ-3D-3DbTkV_OLjSJnqHm8m7-2F-2F56DWnfZJlgeeOxWA0YdMHg-2Bqvd4FnCo0UUQShQ5NiOBCgsW0KxYPxTv1S2fmI6xcn8juyN3Wx49yyxZWbP6C0L-2FB3H8P7BSOLjE3RBO-2FK7WEQBIaTOc84NrDeaVIPKp6u-2F6lvKwhP8RnqZY3OPG5ALPqjE-2BDRa5diJf54oDAvtHe4P96HddXZZtTZvZDsqEmWux3mtZw-3D-3D

Page Load Overview

0.33s
Total Load Time
8 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:261 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software69% confidence
Type: static
Method: ml+structural

All Detected Categories

technology software
69%
documentation technical
32%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3104.21.56.8Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
13.74.193.86Aws · CLOUDFrankfurt am Main, Hesse, Germany
AS16509Amazon.com, Inc.
163.177.222.25Aws · CLOUDFrankfurt am Main, Hesse, Germany
AS16509Amazon.com, Inc.
53--

Detected Technologies1

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T17782B5565EF3102AAD73D0696FD76206A3278017F409CD28BF8C53488F85688DBADBDC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:BrgN8elhlgOIokNppsd/Gx8xH1xeC1YkpsYgLrZKjui2d7+I+++XgNR8wc+Y4ltt:BrW5RYKkiUZ+++mawhyEh4o/e4Z95

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:19115:BEaiOKAABAQAQmxAxCBBRuBKDUAIrghhQocQALA6unICUxAaIDC9A5AJvUQvlEUUEGdIW4yAjAmExkFIAQgUAAzcAIphgoiM

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00191f1f071f7fef
Perceptual Hash:8e5cf27076487636
Difference Hash:b5ab2bb33fd5d68c
Wavelet Hash:00191b1f070f3fef
Color Hash:#406cbf

Other Hashes

Crop Resistant:b5ab2bb33fd5d68c

Scan History

Scan history not available

Unable to load historical scan data