ScanMalware.com

Security Scan Report: 52.123.255.160

Redirected to:
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_...
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/9a4192cc-de7a-4d0f-bcf7-a849d316687eDomain and IP registration (RDAP)/api/v1/rdap/9a4192cc-de7a-4d0f-bcf7-a849d316687eHow often this domain was scanned/api/v1/domain/stats/52.123.255.160Scan history for this domain/api/v1/domain/history/52.123.255.160?limit=15
This website contacted 13 IPs in 5 countries across 6 domains to perform 49 HTTP transactions. The main domain is microsoftonline.com and was registered 24 years ago.

Submitted URL: https://52.123.255.160

Effective URL:
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_...
Redirected

AI Security Verdict

Low Risk

Confidence: 87%

3
Risk Score

Raw-IP host branded as Microsoft Outlook that bounces to Microsoft's real OAuth page with redirect_uri pointing back to the IP — an authorization-code/token-stealing phishing flow. Do not sign in.

Risk Factors (5)
Brand impersonation of Microsoft Outlook on a raw IP address
OAuth redirect_uri points back to the attacker-controlled IP, enabling authorization-code / token theft for Microsoft 365 mail
Bot protection bypassed: datacenter scanner and residential client receive different content
Entry domain is an unranked bare IP with no legitimate reputation; domain-age/ranking data in the report belongs to the redirect target, not this host
Medium IDS alert for Microsoft OAuth 2.0 device authorization activity
Safety Factors (5)
The final sign-in page is served from the genuine login.microsoftonline.com domain, so credentials typed there go to Microsoft
No threat-intelligence matches against loaded resources
No JavaScript malware or known phishing-kit signatures detected
Cross-origin analytics/XHR to Microsoft domains is ordinary telemetry
The site's own login form (credentials submit to its own domain; 8869 days old) with no strong malicious indicators — a first-party sign-in is normal; risk clamped from 9 to 3
Domain age information unavailable

Details

Page Title

Outlook

Scan Type

public

Domain Name Analysis

The domain '52.123.255.160' uses an unknown top-level domain. The core label '52.123.255.160' covers 14 characters with 0 vowels and zero consonants; bonus characters include eleven digits. Segmentation suggests 4 words: 52, 123, 255, 160. Expect three characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://52.123.255.160

Page Load Overview

1.19s
Total Load Time
3.0 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:73%
Script:Latin
Direction:ltr

Detection Details

Text Length:35 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software72% confidence
Type: static
Method: ml+structural+ocr_tiebreaker

All Detected Categories

technology software
72%
social media network
26%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1352.123.255.160Office365 · CLOUDTel Aviv, Tel Aviv, Israel
AS8075Microsoft Corporation
3104.109.143.95Akamai · CDNHaarlem, North Holland, Netherlands
AS20940Akamai International B.V.
320.190.160.128Azure · CLOUDAmsterdam, North Holland, Netherlands
AS8075Microsoft Corporation
3104.109.143.77Akamai · CDNHaarlem, North Holland, Netherlands
AS20940Akamai International B.V.
3104.109.143.94Akamai · CDNHaarlem, North Holland, Netherlands
AS20940Akamai International B.V.
3104.109.143.76Akamai · CDNHaarlem, North Holland, Netherlands
AS20940Akamai International B.V.
320.190.160.131Azure · CLOUDAmsterdam, North Holland, Netherlands
AS8075Microsoft Corporation
323.207.210.132Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
323.207.210.136Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
34.207.44.69Azure · CLOUDDublin, Leinster, Ireland
AS8075Microsoft Corporation
4913--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T102621C6058445839FF13B365EBE7FE0D363A6287FC228E5CA2AD639808C1FD85617572

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:6MZ4vijFNEvQKCtt3GsXGA2CM1fAJA0JAs0t:6M6ASQtt/RgIsD

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:15643:ckIGA1Cb+rJiQQAMIJAEgkOEFUw3tCAKgCRgJKsEJDEQAYBIGBqgkJFGNLsALhFekNJZlLHmgHSGBAKoJKVhRQIAGEIACSQH

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffffffe7e7ffffe7
Perceptual Hash:e689996666999966
Difference Hash:0008000c0c000008
Wavelet Hash:0f0f1f0720303c24
Color Hash:#1f5393

Other Hashes

Crop Resistant:0008000c0c000008

Scan History

Scan history not available

Unable to load historical scan data