Security Scan Report: gasevinul.z1.web.core.windows.net

Submitted: Completed: publiccompleted
This website contacted 3 IPs in 2 countries across 2 domains to perform 23 HTTP transactions. The main domain is windows.net and was registered 31 years ago.

Submitted URL: https://gasevinul.z1.web.core.windows.net/gx/index.html

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Fake Windows Defender alert impersonating Microsoft, claiming the PC is infected and locked with instructions to call 'Windows Support'. Google Safe Browsing flags it for social engineering — a textbook tech support scam; do not call or interact.

Risk Factors (5)
Brand impersonation of Microsoft / Windows Defender on an unrelated cloud-storage subdomain
Google Safe Browsing Social Engineering threat
Fabricated malware/virus scan results and fake system-block warning
Pressure tactics: claims data is compromised and registration will be suspended unless the user calls
Hosted on shared cloud storage (z1.web.core.windows.net) with unknown, potentially minutes-old creation date
Domain age information unavailable

Details

Page Title

WIndows Err 2V7HJ9

Scan Type

public

Domain Name Analysis

The domain name 'gasevinul.z1.web.core.windows.net' uses the network infrastructure generic top-level domain (.net); it also runs on subdomain 'gasevinul.z1.web.core'. The core label 'windows' covers 7 characters containing two vowels alongside five consonants. Breaking it apart gives one word: windows. Median word length is seven characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://gasevinul.z1.web.core.windows.net/gx/index.html

Page Load Overview

5.44s
Total Load Time
986 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:3,404 chars
Detector Agreement:67%

Website Classification

Primary Category

technology software50% confidence
Type: spa
Method: ml+structural

All Detected Categories

technology software
50%
government public service
48%
documentation technical
41%
phishing scam
37%
adult content
36%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
920.150.121.129Azure · CLOUDOslo, Oslo, Norway
AS8075Microsoft Corporation
7104.20.44.133Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7172.66.175.107Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
233--

Detected Technologies2

JQueryv1.4.4
100%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1AD041C7C136BCEBEC8F3309BD805A319D66A8F67DBD4689635AFA5000FD2835D18614B

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:1B2J5cevEf9iSQRURxrYCnSUBCamG8ku4dEjIy:1B2HceAZQR8xrYCnSUBC3G89qWIy

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:189554:ZC0oOgExRIgJCsUoGIbA5B3EBAycCE8SACAzGQHaSkIjIoKIZlwTgeChGJNGJBLpAGQWp4kAiMiJUmQA44gQBxa4cTAkgOG5

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:3c3c3c3c3c3c3800
Perceptual Hash:cbcb3cb334acb130
Difference Hash:c9c9e9e1c9c97115
Wavelet Hash:7c3c3c3c3c7c7c01
Color Hash:#77862d

Scan History

Scan history not available

Unable to load historical scan data