Security Scan Report: login.friedli-partner.ch

Redirected to:
https://login.friedli-partner.ch/portal/session/authorize?client_id=47...
Site favicon
Submitted: Completed: publiccompleted
This website contacted 1 IP in 1 country across 5 domains to perform 24 HTTP transactions. The main domain is friedli-partner.ch.

Submitted URL: https://login.friedli-partner.ch/

Effective URL:
https://login.friedli-partner.ch/portal/session/authorize?client_id=47...
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 95%

10
Risk Score

Cloned Microsoft sign-in on the non-Microsoft host login.friedli-partner.ch, self-hosting Microsoft's login schema and harvesting email/password — adversary-in-the-middle credential phishing.

Risk Factors (5)
Microsoft login cloned/hosted on an unrelated domain (brand impersonation)
Password-collecting login form on a domain that is not the impersonated brand's
Azure AD / Office home lookalike subdomains (aadcdn, sso, officehome) under the attacker domain
Self-hosted Microsoft $Config login schema instead of redirecting to login.microsoftonline.com, consistent with an adversary-in-the-middle proxy capable of stealing credentials and session/MFA tokens
Phishing threat-intelligence match on the login endpoint
Domain age information unavailable

Details

Page Title

Sign in to your account

Scan Type

public

Domain Name Analysis

The domain name 'login.friedli-partner.ch' uses the Swiss country-code top-level domain (.ch), featuring subdomain 'login'. Its registrable label 'friedli-partner' stretches across 15 characters containing five vowels alongside 9 consonants, plus 1 hyphen. Tokenizing the label suggests 3 words: friedl, i, partner. Median word length is 6 characters. No strong language cues emerged from the frequency lists.

Screenshot

Microsoft Sign in Email, phone, or Skype No account? Create one! Can’t access your account? G Continue with Google @ Continue with Apple ‘Terms of use Privacy & cookies

Page Load Overview

2.50s
Total Load Time
1.7 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:196 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software65% confidence
Type: webapp
Method: ml+structural

All Detected Categories

technology software
65%

Detected Features

Login Form
Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
24185.145.148.212Switzerland
AS15623Cyberlink AG
241--

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T19BB37FE97AA72937828A44F5B9B62E02AE77AD039C4CDC6CB45CDC441FEB90C8177503

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:rdU8gugGgT8GLG2s+xvUYgoVgTCGDtnKaNg7R5Z9Tjuokmap5vPoMYut+bk6iQQV:5VNRg8WvtvyTdNwra/Az9C

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:108048:DwNMiImXIgkaCpIgIE+ApOAECaA2iTAgoDJeIIgOknQgEYvhCZjaxBoBAQCMKyhMgogW1DKAgB+GmBITrtYSNFgmQEaMAEHJ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00183933373f3737
Perceptual Hash:8559717666739989
Difference Hash:88f2d2e7e5dae6e6
Wavelet Hash:001839333f3f3737
Color Hash:N/A

Other Hashes

Crop Resistant:88f2d2e7e5dae6e6

Scan History

Scan history not available

Unable to load historical scan data