Security Scan Report: vagesomay.z21.web.core.windows.net

Redirected to:
https://vagesomay.z21.web.core.windows.net/ctgdctopacg/index.html?phon...
Site favicon
Submitted: Completed: publiccompleted
This website contacted 2 IPs in 1 country across 2 domains to perform 22 HTTP transactions. The main domain is windows.net and was registered 31 years ago.

Submitted URL: https://vagesomay.z21.web.core.windows.net/?phone=050-3095-4311

Effective URL:
https://vagesomay.z21.web.core.windows.net/ctgdctopacg/index.html?phon...
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Fake Microsoft Defender scareware on an Azure storage subdomain; Google Safe Browsing flags Social Engineering. It claims trojans and data theft and pushes victims to call 050-3095-4311 for 'support'.

Risk Factors (7)
Google Safe Browsing Social Engineering verdict
Microsoft brand impersonation on an unrelated cloud-storage host
Classic tech-support-scam scareware copy (fake infection, data-leak and license-suspension threats)
Hosted on user-controlled Azure Blob Storage subdomain; actual page age unknown
Page loads a fake login form (username/password fields rendered) alongside the scam
Cross-origin fetch to ipwho.is for visitor IP geolocation, used to localize the scare (Germany/Falkenstein IP shown)
Network IDS alert: ET INFO External IP Lookup Domain in DNS Lookup (ipwho.is)
Domain age information unavailable

Details

Page Title

読み込みエラー

Scan Type

public

Domain Name Analysis

Within the network infrastructure generic top-level domain (.net), 'vagesomay.z21.web.core.windows.net' is registered and includes subdomain 'vagesomay.z21.web.core'. The second-level label 'windows' is 7 characters long containing two vowels alongside 5 consonants. Word splitting yields one word: windows. Average segment length settles at seven characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://vagesomay.z21.web.core.windows.net/?phone=050-3095-4311

Page Load Overview

7.18s
Total Load Time
525 KB
Total Size

Language Analysis

Primary Language

🇯🇵Japanese
Code: ja
Confidence:80%
Script:Mixed
Direction:ltr

Detection Details

HTML Lang Attribute:ja
Text Length:1,565 chars
Detector Agreement:100%

Website Classification

Primary Category

documentation technical100% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

documentation technical
100%
blog personal website
100%
government public service
100%
social media network
100%
phishing scam
100%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1120.209.27.237Azure · CLOUDSan Antonio, Texas, United States
AS8075Microsoft Corporation
11172.66.175.107Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
222--

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T186A2522895F6546310A28081A965AF8B3F44DE03D6172B0533BC87A2BFD7D9BDC072BD

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:+bcn1IVMMn2D6yRSA7MrgufgC7SgaEyX4X/MiR15XXEPThPfcRRrD5YBFn/ZRMdH:ocn1IVMMnc0AOnfgGX/OpfY

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:21659:QAfqAmEgBoQA2IYCkybkgRABVAYxoFrogAGBAwlS1FCAiisZCKkQGAQnGlwQ5WH4KQADQ6SESIEKxAWAQgQMBQiNBSINyQMB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff00000000ffffff
Perceptual Hash:8f05b8e1e3de9630
Difference Hash:68f27070d37c2b61
Wavelet Hash:ff00000000ffffff
Color Hash:#b9e06c

Scan History

Scan history not available

Unable to load historical scan data