Security Scan: Continue

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/fc6d4d53-a5f9-4bfb-909e-601cfb8de07a Domain and IP registration (RDAP)/api/v1/rdap/fc6d4d53-a5f9-4bfb-909e-601cfb8de07a Certificate Transparency/api/v1/ct/outlook.office365.com How often this domain was scanned/api/v1/domain/stats/outlook.office365.com.mcas-gov.ms Scan history for this domain/api/v1/domain/history/outlook.office365.com.mcas-gov.ms?limit=15

This website contacted 7 IPs in 2 countries across 4 domains to perform 19 HTTP transactions. The main domain is outlook.office365.com and was registered 3 years 4 months ago.

Submitted URL: https://outlook.office365.com.mcas-gov.ms

Effective URL:

https://outlook.office365.com/mail/?

Redirected

The Cisco Umbrella rank of the primary domain is #99,365 of the top 1 million websites

AI Security Verdict

Moderate Risk

Confidence: 55%

Risk Score

Interstitial 'Continue' page on a hostname that nests office365.com under mcas-gov.ms, then redirects to genuine Outlook. No forms, no Indicators of Compromise, no YARA or IDS hits — no credential harvesting; likely Microsoft MCAS proxy, but the deceptive hostname warrants caution.

Risk Factors (3)

Deceptive hostname structure: outlook.office365.com.mcas-gov.ms places a Microsoft brand hostname as a subdomain of a third registrable domain

174 Function() constructor calls in loaded JavaScript (code generation, requires corroboration; common in large vendor bundles)

Entry domain (mcas-gov.ms) is unranked/unknown repute and its age cannot be attributed to the page actually served at outlook.office365.com

Safety Factors (5)

Final URL resolves to the genuine outlook.office365.com mail endpoint

No credential, login, or payment form present — nothing is harvested on this page

No Indicators of Compromise, YARA, Safe Browsing or IDS evidence of phishing or malware

The URL pattern matches Microsoft Defender for Cloud Apps (MCAS) session-proxy rewriting of an Office 365 URL, which is legitimate Microsoft infrastructure behaviour

Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 4 to 4

Domain age information unavailable

Details

Page Title

Continue

Scan Type

public

Favicon Hash

MMH3: -1249852061

MD5: ac16fa7fc862073b02acd1187fc6def4

Domain Name Analysis

You're looking at domain 'outlook.office365.com.mcas-gov.ms' on the .ms country-code top-level domain and includes subdomain 'outlook.office365.com'. The second-level label 'mcas-gov' is 8 characters long holding two vowels versus five consonants, notching one hyphen. Breaking it apart gives three words: mc, as, gov. Expect 2 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

3.46s

Total Load Time

595 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:73%

Script:Latin

Direction:ltr

Detection Details

Text Length:35 chars

Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence

Type: static

Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
7	52.227.10.254Azure · CLOUD	Boydton, Virginia, United States	AS8075Microsoft Corporation
2	20.140.151.75	San Antonio, Texas, United States	AS8070Microsoft Corporation
2	104.18.18.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	104.18.19.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	52.98.252.242Office365 · CLOUD	Frankfurt am Main, Hesse, Germany	AS8075Microsoft Corporation
2	52.98.179.162Office365 · CLOUD	Frankfurt am Main, Hesse, Germany	AS8075Microsoft Corporation
2	40.99.149.98Office365 · CLOUD	Frankfurt am Main, Hesse, Germany	AS8075Microsoft Corporation
19	7	-	-