Security Scan Report: danos.z13.web.core.windows.net

Redirected to:
https://mail26.serverlet.top/_andromeda_oxy/?login=6b6276@blackfridayb...
Submitted: Jun 17, 2026, 10:12:25 AMCompleted: Jun 17, 2026, 10:13:44 AMpubliccompleted
Loading additional data...

Summary

This website contacted 2 IPs in 1 country across 2 domains to perform 2 HTTP transactions. The main domain is mail26.serverlet.top and was registered NaN years ago.

Submitted URL: https://danos.z13.web.core.windows.net/bab.html#[email protected]

Effective URL: https://mail26.serverlet.top/_andromeda_oxy/[email protected]&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=nullRedirected

The Cisco Umbrella rank of the primary domain is #44 of the top 1 million websitesTop 100 Site

AI Security Verdict

Moderate Risk

Confidence: 80%

5
Risk Score

Page redirects to an unknown domain, embeds an email in the URL and contains a hidden form with eval() calls – strong phishing indicators despite no visible credential fields.

Risk Factors
Email in URL fragment used as phishing lure
Redirect to untrusted domain
Eval() usage in JavaScript
Hidden form field (cf-turnstile-response) without visible inputs
Unknown creation date of subdomain on hosting platform
Safety Factors
Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 8 to 5
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Language

🇺🇸

English

(66% confidence)

Category

documentation technical

(45%)

Domain Information

You're looking at domain 'danos.z13.web.core.windows.net' on the network infrastructure generic top-level domain (.net) with subdomain 'danos.z13.web.core'. The second-level label 'windows' is 7 characters long with two vowels and five consonants. Word splitting yields one word: windows. Average segment length settles at 7 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://danos.z13.web.core.windows.net/bab.html#6b6276@blackfridaybluetoothheadset.bloggy.se

Page Load Overview

1.42s
Total Load Time
22
HTTP Requests
5
Domains
35 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:66%
Script:Latin
Direction:ltr

Detection Details

Language Code:en
Detection Confidence:66%
Script Type:Latin
Text Length:54 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical45% confidence
Type: static
Method: ml+structural

All Detected Categories

documentation technical
45%
news media journalism
45%
phishing scam
40%
healthcare medical
39%
e-commerce shopping
31%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
11172.67.204.249United States
AS13335Cloudflare, Inc.
1157.150.155.68Washington, Virginia, United States
AS8075Microsoft Corporation
222--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1024164B97D1A92349A125196313DE35D3C33E065BF01848486ECCC399D58FDA08BBEAD

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

48:Ltx8isEZHKWrGLrGWASTw2wptI8Id65OS:LGT8Nnx/Iq

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:1879:AAAAEgbAAgAIBMIBIABBlEAiBIAAABAAADYQAAAAgAAEAAAAAABAAABABoCAAAQAAAAAAACAAAAAQCAIAAUAEAiEA0AAgiiB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:3f7fffffffffffff
Perceptual Hash:83070707070f1fff
Difference Hash:c080000000000000
Wavelet Hash:30f0f0f0f0f0f0f0
Color Hash:#3b783a

Other Hashes

Crop Resistant:c080000000000000

Scan History

Scan history not available

Unable to load historical scan data