Security Scan Report: csmgroup.blu-foods.com

Redirected to:
https://csmgroup.blu-foods.com/?sso_reload=true
Site favicon
Submitted: Completed: publiccompleted
This website contacted 13 IPs in 4 countries across 6 domains to perform 32 HTTP transactions. The main domain is blu-foods.com and was registered 2 years ago.

Submitted URL: https://csmgroup.blu-foods.com/login?method=signin&mode=secure&client_id=db30ed6-53592-41922-0d22-aaab5901c&privacy=on&sso_reload=true&redirect_urI=https%3A%2F%2Flogin.microsoftonline.com%2F

Effective URL:
https://csmgroup.blu-foods.com/?sso_reload=true
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 96%

9
Risk Score

Cloned Microsoft sign-in hosted on csmgroup.blu-foods.com with Microsoft's login $Config and a password form posting to the same host — adversary-in-the-middle credential and MFA theft. Do not enter credentials.

Risk Factors (5)
Brand impersonation of Microsoft on an unrelated, unranked domain
Credential-harvesting login form (email + password) submitting to the attacker-controlled host path
Self-hosted Microsoft login $Config indicating adversary-in-the-middle capability that can also capture MFA session tokens
Obfuscated/misspelled 'redirect_urI' parameter mimicking a legitimate OAuth redirect to login.microsoftonline.com
Domain csmgroup.blu-foods.com is unranked and hosts an unrelated SSO clone, consistent with a compromised or abused legitimate domain
Domain age information unavailable

Details

Page Title

Sign in to your account

Scan Type

public

Domain Name Analysis

The domain 'csmgroup.blu-foods.com' uses the commercial generic top-level domain (.com), featuring subdomain 'csmgroup'. The second-level label 'blu-foods' is 9 characters long containing 3 vowels alongside five consonants, notching one hyphen. It segments into two words: blu, foods. The median word length lands at 4 characters. No strong language cues emerged from the frequency lists.

Screenshot

Microsoft Sign in Email, phone, or Skype No account? Create one! Can’t access your account? ‘Termsof use Privacy & cookies +

Page Load Overview

0.21s
Total Load Time
4 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:133 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software80% confidence
Type: webapp
Method: ml+structural+ocr_tiebreaker

All Detected Categories

technology software
80%
social media network
32%

Detected Features

Login Form
Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
8216.239.34.21Google · CDNUnited States
AS15169Google LLC
2216.239.38.21Google · CDNUnited States
AS15169Google LLC
240.126.31.67Office365 · CLOUDDublin, Leinster, Ireland
AS8075Microsoft Corporation
223.207.210.132Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
220.190.160.132Office365 · CLOUDAmsterdam, North Holland, Netherlands
AS8075Microsoft Corporation
2150.171.74.13Azure · CLOUDUnited States
AS8075Microsoft Corporation
2216.239.36.21Google · CDNUnited States
AS15169Google LLC
220.190.159.4Office365 · CLOUDDublin, Leinster, Ireland
AS8075Microsoft Corporation
223.207.210.136Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
220.190.160.65Office365 · CLOUDAmsterdam, North Holland, Netherlands
AS8075Microsoft Corporation
3213--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T12D834CEA7EA21D37828A81B5B5797D02AE3A5907894CCDA0F19CCD842FEB74D8127513

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:aTUb8GLG25xPmJhjLDHPZ9Tjuokmap5vPoMOuB71niiQ+a3g:Y68iQJpLja/Av+a3g

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:84290:MDAiIIYBAARSIwAQOAllaE30tCVAgACgCqx04h6EIBgEFYYFZTlIBmEUpD2AAAIJaYCwyQ4YTGFIUBCMIwIIrMYBAHESylCa

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0010393b373f3737
Perceptual Hash:845971764699d96e
Difference Hash:88e4d2d3e5e6e6e6
Wavelet Hash:00003b3b373f373f
Color Hash:07000000180

Other Hashes

Crop Resistant:88e4d2d3e5e6e6e6

Scan History

Scan history not available

Unable to load historical scan data