Security Scan Report: cpipe.ink

Redirected to: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d76b3532-2bf4-4c0b-a1ff-80785eb117a0&response_type=code&redirect_uri=https%3A%2F%2Fqa.cocopipe.com%2Fauth%2Fmicrosoft%2Fcallback&response_mode=query&scope=openid+profile+email+User.Read&state=RJmb7zpKWi6mmpSKss8d7sELIeu0nQeCpPTx8MqM&prompt=select_account&sso_reload=true

Submitted: Mar 21, 2026, 3:23:38 PMCompleted: Mar 21, 2026, 3:24:46 PMpubliccompleted
Loading additional data...

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 1 HTTP transaction. The main domain is login.microsoftonline.com and was registered NaN years ago.

Submitted URL: https://cpipe.ink/auth/microsoft/redirect

Effective URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=d76b3532-2bf4-4c0b-a1ff-80785eb117a0&response_type=code&redirect_uri=https%3A%2F%2Fqa.cocopipe.com%2Fauth%2Fmicrosoft%2Fcallback&response_mode=query&scope=openid+profile+email+User.Read&state=RJmb7zpKWi6mmpSKss8d7sELIeu0nQeCpPTx8MqM&prompt=select_account&sso_reload=trueRedirected

AI Security Verdict

High Risk

Confidence: 92%

8
Risk Score

Phishing page impersonating Microsoft login, harvesting credentials via a cross‑origin form.

Risk Factors
Cross‑origin credential form to Microsoft login endpoint
Brand impersonation of Microsoft on a non‑official domain
Login form collecting email and password
Domain age information unavailable

Details

Page Title

Sign in to your account

Scan Type

public

Language

🇺🇸

English

(80% confidence)

Category

unknown

(0%)

Domain Information

You're looking at domain 'cpipe.ink' on the .ink top-level domain while skipping any subdomain. Its registrable label 'cpipe' stretches across 5 characters split between two vowels and three consonants. Breaking it apart gives two words: c, pipe. Median word length comes out to 2.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://cpipe.ink/auth/microsoft/redirect

Page Load Overview

0.74s
Total Load Time
30
HTTP Requests
4
Domains
502 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

Language Code:en
Detection Confidence:80%
Script Type:Latin
HTML Lang Attribute:en
Text Length:133 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: webapp
Method: structural

All Detected Categories

No categories detected

Detected Features

Login Form
Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
523.207.210.137Frankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
520.50.201.195Ireland
520.190.159.4Dublin, Leinster, Ireland
AS8075Microsoft Corporation
513.107.246.44UnknownUnknown
520.190.159.73UnknownUnknown
5104.21.1.16UnknownUnknown
306--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A6835BEA7EB3293B878546B5B8B96D02AE3A59034C4CCC64B15CC8942FFB75D8137507

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:jG8GLG2vTSVoIyEk77gx2xpTvPoMmCB/Efii7/C:S8E2VJ32RAT/C

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:83269:gAneABaKZLNCAlJCysKUQDkBBQiBY4QsjCAMEYGsY0j4HlAFISJJgGEjAS6UgIFlJcjjKVAZNggQvAMMlJniCQQABBCFKUFy

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0010393b373f373f
Perceptual Hash:845971764699d96e
Difference Hash:88e4d2d3e5e6e6e6
Wavelet Hash:00003b3b373f373f
Color Hash:#d2bf79

Other Hashes

Crop Resistant:88e4d2d3e5e6e6e6

Scan History

Scan history not available

Unable to load historical scan data