Security Scan Report: movecogi.z16.web.core.windows.net

Redirected to:
https://movecogi.z16.web.core.windows.net/cvpbqha/4agpo330fmhq.html
Submitted: Completed: publiccompleted
This website contacted 4 IPs in 2 countries across 4 domains to perform 17 HTTP transactions. The main domain is windows.net and was registered 31 years ago.

Submitted URL: https://movecogi.z16.web.core.windows.net/cvpbqha/

Effective URL:
https://movecogi.z16.web.core.windows.net/cvpbqha/4agpo330fmhq.html
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 94%

10
Risk Score

Cloaked fake Windows Defender alert with a support phone number on an Azure blob host; Safe Browsing social-engineering hit plus phishing threat-intel. Tech support scam — do not call the number.

Risk Factors (6)
Safe Browsing social-engineering detection
Impersonation of Microsoft Windows Defender on a non-Microsoft azure blob subdomain
Deceptive call-back phone number presented as technical support
Content cloaking / obfuscated inline scripts and disabled context menu
Network traffic to iplogger.com IP-logging service and unranked .cfd domain
Hosted on shared cloud storage subdomain with random paths, no legitimate identity
Domain age information unavailable

Details

Page Title

キャンペーン情報

Scan Type

public

Domain Name Analysis

The domain name 'movecogi.z16.web.core.windows.net' uses the network infrastructure generic top-level domain (.net), featuring subdomain 'movecogi.z16.web.core'. The core label 'windows' covers 7 characters holding two vowels versus five consonants. Segmentation suggests one word: windows. The median word length lands at seven characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://movecogi.z16.web.core.windows.net/cvpbqha/

Page Load Overview

1.35s
Total Load Time
964 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-GB
Text Length:97,788 chars
Detector Agreement:100%

Website Classification

Primary Category

healthcare medical60% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

healthcare medical
60%
cryptocurrency blockchain
59%
news media journalism
48%
education learning
45%
technology software
38%

Detected Features

OG: product
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
520.150.84.193Azure · CLOUDDublin, Leinster, Ireland
AS8075Microsoft Corporation
4172.67.144.146Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4104.17.24.14Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4172.67.188.178Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
174--

Detected Technologies7

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A0F39D1CA78C3839002342672D8A7688167EDE37E1511DD6717E942E7F89F9CDE0E6B8

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:vYrU3Eb/TwqNOvIwiDkp3WgQkCYFBGiL2pSOc14582Blt:vJ0hNO5ipkCY1LlOdbl

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:166961:AESBYHGMCjNTlzMgJAgACMgCAgoDCCQAQEgAIDiIkBnAETCp4MAjgGWXLaXkYlp6IB0z0LqskADIooGiGBVmpg5jAOwQEBiQ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:283c3c3c3c3c0000
Perceptual Hash:cbc33466343c8f3c
Difference Hash:c9c9e9e9e1e9f1bf
Wavelet Hash:3c7c7c7c7c7c3800
Color Hash:N/A

Scan History

Scan history not available

Unable to load historical scan data