Security Scan Report: microsoft.dropcloud.it

Site favicon
Submitted: Completed: publiccompleted
This website contacted 17 IPs in 3 countries across 13 domains to perform 30 HTTP transactions. The main domain is dropcloud.it and was registered 3 years 1 month ago.

Submitted URL: https://microsoft.dropcloud.it/accountmicrosoft365/security/review-activity?rid=ktrFbSw

AI Security Verdict

High Risk

Confidence: 60%

7
Risk Score

Italian phishing-simulation awareness page that openly says it is a drill, with no forms or credential capture; risk comes from the 'microsoft' look-alike hostname and one unverified phishing report.

Risk Factors (3)
Deceptive hostname using the 'microsoft' brand on a third-party domain (dropcloud.it)
Single-source unverified phishing threat-intel report on the primary domain
Unranked domain, no established reputation despite 3-year age
Domain age information unavailable

Details

Page Title

Simulazione attacco reale

Scan Type

public

Domain Name Analysis

Domain 'microsoft.dropcloud.it' uses the Italian country-code top-level domain (.it) and includes subdomain 'microsoft'. The core label 'dropcloud' covers 9 characters containing 3 vowels alongside six consonants. Splitting it apart reveals two words: drop, cloud. Average segment length settles at 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

; 3 Attenzione, î Annota questi segnali sospetti simulazione di un > {mittente ha un indirizzo email generico che non appartiene allorganizzazione di cu s na attacco reale! finge parte + ) Il messag...

Page Load Overview

0.84s
Total Load Time
682 KB
Total Size

Language Analysis

Primary Language

🇮🇹Italian
Code: it
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:it
Text Length:627 chars
Detector Agreement:100%

Website Classification

Primary Category

phishing scam41% confidence
Type: static
Method: ml+structural+ocr_tiebreaker

All Detected Categories

phishing scam
41%
adult content
35%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1454.171.110.222Aws · CLOUDDublin, Leinster, Ireland
AS16509Amazon.com, Inc.
1104.18.11.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1162.159.128.61Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
154.246.37.32Aws · CLOUDDublin, Leinster, Ireland
AS16509Amazon.com, Inc.
1151.101.65.155Fastly · CDNUnited States
AS54113Fastly, Inc.
1104.17.25.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
152.214.103.112Aws · CLOUDDublin, Leinster, Ireland
AS16509Amazon.com, Inc.
1104.18.10.207Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1151.101.129.155Fastly · CDNUnited States
AS54113Fastly, Inc.
1104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3017--

Detected Technologies8

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T166E2E936425D25B668383EBFC6BE780C5644F14366538755F0EF1EE48B2EB2E248B16C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:tCtPKcdBi9/Bm6wF1G52d3ysYgYgNI69e7R:AtynUeztF

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:31455:h4wwHARAk4AFieFEYkAChF5BL2kbkkBZSBpiNIFTJ0BpCGKCgoLsCQwcAAwiEEOMSAPEpcIKRE8ZYRiJgOABCRLBiU2SBAls

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:003c7e7c64642000
Perceptual Hash:c39c3c637ccc929a
Difference Hash:23dcd0c8c9c9cb34
Wavelet Hash:007e7e7e7e7e6000
Color Hash:02000000007

Scan History

Scan history not available

Unable to load historical scan data