Windows Analysis Report
https://l.facebook.com/l.php?u=https%3A%2F%2Fnutramart.store%2F%3Flabel%3D5efe465a4dbe59fbb290a966697fc1cd%26utm_medium%3Dpaid%26utm_source%3Dfb%26utm_id%3D6599688580361%26utm_content%3D6599688599961%26utm_term%3D6599688590961%26utm_campaign%3D6599688580361%26fbclid%3DIwZXh0bgNhZW0BMAABHdzmJULh8TsQt

• EGA enabled

{"loginform": false,"urgency": true,"captcha": false,"reasons": ["The text creates a sense of urgency by warning the user that their changes may not be saved if they leave the site.","The use of phrases like 'Threat Detected' and 'Access has been blocked' are designed to scare the user into taking action.","The presence of a phone number for 'Microsoft Windows Support' suggests that this page may be trying to phish for sensitive information."]}

```json
{
  "phishing_score": 9,
  "brands": "Microsoft",
  "phishing": true,
  "suspicious_domain": true,
  "has_prominent_loginform": false,
  "has_captcha": false,
  "setechniques": true,
  "has_suspicious_link": true,
  "legitmate_domain": "microsoft.com",
  "reasons": "The URL 'https://qi7cfdo3mg0fby.azureedge.net/7720/?utm_medium=paid&utm_source=fb&utm_id=6599688580361&utm_content=6599688599961&utm_term=6599688590961&utm_campaign=6599688580361&fbclid=IwZXh0bgNhZW0BMAABHdzmJULh8TsQt3pW_qnmIXPFdqLqBaBKW5T-aZYxDkCqac1lwtitUH-fNw_aem_UoCoKjZX08yMSHQS1Rk-lA' is suspicious as it does not match the legitimate domain 'microsoft.com' associated with the brand Microsoft. The page uses social engineering techniques such as alarming messages about threats and urging the user to contact support, which is a common tactic in phishing attacks. The presence of a suspicious link and the use of a subdomain that does not belong to the official Microsoft domain further indicate that this is likely a phishing site."
}

{"phishing_score": 10, "brand_name": "Microsoft", "reasons": "The URL 'qi7cfdo3mg0fby.azureedge.net' is not associated with Microsoft's official domains, and the domain appears suspicious due to its unusual format. The webpage displays a warning message about changes to the site, which is unusual for a legitimate Microsoft update. The presence of Microsoft Support and Security Support links is misleading, as these links are not associated with Microsoft's official domains. The webpage's attempt to trick users into downloading malware is a clear indication of phishing."}

{"loginform": false,"urgency": true,"captcha": false,"reasons": ["The text creates a sense of urgency by instructing the user to take immediate action to avoid negative consequences such as data loss and confidential information leak.","The text implies that the user's device is infected with a dangerous ransomware and that a technician can help solve the problem.","The text includes a phone number for the user to contact Microsoft Windows Support.","The text includes a warning about potential data theft due to COVID-19 and outdated versions of the browser."]}Explanation:* The webpage does not contain a login form as there is no explicit request for sensitive information such as passwords, email addresses, usernames, phone numbers or credit card numbers.* The text creates a sense of urgency by instructing the user to take immediate action to avoid negative consequences such as data loss and confidential information leak.* The webpage does not contain a CAPTCHA or anti-robot detection mechanism.* The reasons provided in the array of strings are based on the analysis of the text and the potential impact on the user.

{"loginform": false,"urgency": true,"captcha": false,"reasons": ["The text creates a sense of urgency by using phrases such as 'Virus must removed immediately!', 'A critical has due to the cwtdated Of the browser.', 'Threat Detected: xxbc Detected Address 'P: 8.46.123.33', 'Contact Microsoft Windows Support: +1-833-890-7720 immediately.', 'Due to COVID-19, data theft incidents via a ulent advertsement that injects to pur browser Microsoft Windows have increased by 624K Beca use of this.'","The webpage does not contain a login form, but it does ask the user to contact Microsoft Windows Support using a phone number.","The webpage does not contain a CAPTCHA or any other anti-robot detection mechanism."]}

```json
{
  "phishing_score": 9,
  "brands": "Microsoft",
  "phishing": true,
  "suspicious_domain": true,
  "has_prominent_loginform": false,
  "has_captcha": false,
  "setechniques": true,
  "has_suspicious_link": true,
  "legitmate_domain": "microsoft.com",
  "reasons": "The URL 'https://qi7cfdo3mg0fby.azureedge.net/7720/?utm_medium=paid&utm_source=fb&utm_id=6599688580361&utm_content=6599688599961&utm_term=6599688590961&utm_campaign=6599688580361&fbclid=IwZXh0bgNhZW0BMAABHdzmJULh8TsQt3pW_qnmIXPFdqLqBaBKW5T-aZYxDkCqac1lwtitUH-fNw_aem_UoCoKjZX08yMSHQS1Rk-lA' is suspicious because it uses a subdomain of 'azureedge.net' which is not directly associated with Microsofts primary domain 'microsoft.com'. The image shows multiple warning messages and prompts to contact a support number, which is a common social engineering technique used in phishing attacks. The presence of a prominent support contact number and alarming messages about a virus infection are indicative of phishing attempts. The site does not have a login form or CAPTCHA, but the overall presentation and URL are highly suspicious."
}

```json
{
  "phishing_score": 9,
  "brands": "Microsoft",
  "phishing": true,
  "suspicious_domain": true,
  "has_prominent_loginform": false,
  "has_captcha": false,
  "setechniques": true,
  "has_suspicious_link": true,
  "legitmate_domain": "microsoft.com",
  "reasons": "The URL 'https://qi7cfdo3mg0fby.azureedge.net/7720/?utm_medium=paid&utm_source=fb&utm_id=6599688580361&utm_content=6599688599961&utm_term=6599688590961&utm_campaign=6599688580361&fbclid=IwZXh0bgNhZW0BMAABHdzmJULh8TsQt3pW_qnmIXPFdqLqBaBKW5T-aZYxDkCqac1lwtitUH-fNw_aem_UoCoKjZX08yMSHQS1Rk-lA#' is suspicious because it uses 'azureedge.net' which is not the primary domain for Microsoft. The image shows multiple warning messages designed to scare the user into calling a support number, a common social engineering technique. The legitimate domain for Microsoft is 'microsoft.com'. The site does not have a prominent login form or captcha, but it does use social engineering techniques and contains suspicious links. Therefore, it is highly likely to be a phishing site."
}

{"phishing_score": 9, "brand_name": "Microsoft Windows Security Center", "reasons": "The domain 'qi7cfdo3mg0fby.azureedge.net' does not match the brand name 'Microsoft Windows Security Center', which is unusual for a legitimate Microsoft security site. The warning message and domain discrepancy suggest that this webpage may be a phishing attempt or a malicious site attempting to exploit the user's trust in Microsoft. Additionally, the presence of a pop-up message with links to 'Update your browser', 'Manage your settings', and 'Leave' is a common tactic used by phishing sites to trick users into divulging sensitive information or downloading malware. The 'Threat Detected' and 'Detected Virus' alerts are also suspicious, as they are often used by phishing sites to create a sense of urgency and panic in the user, leading them to take rash actions without verifying the authenticity of the site. Overall, the combination of these factors suggests a high likelihood of this webpage being a phishing site or a malicious site attempting to exploit the user's trust in Microsoft."}

{"phishing_score": 9, "brand_name": "Microsoft", "reasons": "The webpage appears to be mimicking Microsoft's branding and design, which could be an attempt to trick users into thinking it's legitimate. The presence of a critical error message and a link to 'Microsoft Windows Security Center' is a common tactic used in phishing and malware attacks. The domain does not match Microsoft's typical domain structure, which is a red flag. The warning about a possible virus and the request for user input to update the browser are also common tactics used in phishing and malware attacks. Overall, the webpage appears to be a phishing attempt designed to trick users into providing sensitive information or downloading malware."}