watco.microsoft-notifcation.com

Microsoft

https://watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php?id=60f29657ebf9c47f483976bd43ae6916 Access site

Screenshot

Investigate

Domain watco.microsoft-notifcation.com1 CT host on apex

urlscan

page.domain

VirusTotal

Whois

IP 3.145.232.22

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL https://watco.microsoft-notifcation.com/wa4d1737192/78b65c0…

urlscan

Wayback

archive.today

Cert YR1

crt.sh

Censys

Google CT

Phishunt analysis Beta

22 low suspicionheuristic risk score · not a probability

Why?

+5.3 Keyword match
+5.1 Site cluster
+3.7 Brand in domain label
+3.0 OpenPhish
+1.2 ASN reputation
+1.1 No HSTS header
+0.7 Brand in cert SAN
+0.6 Long domain
+0.6 Login text in screenshot
+0.3 Free CA
+0.2 Executable page
+0.2 Suspicious TLD
+0.1 Hyphens
+0.1 Deep subdomain

18 signals fired · detector v3.0.0

AI analysis AIBeta

Credential harvesting

Microsoft notification phishing site on a typosquatted domain misspelling notification, using a PHP backend and hashed URL structure typical of targeted credential theft. Confirmed malicious by OpenPhish. Hosted on Amazon AWS with a same-origin login form.

OpenPhishBrand in domain labelExecutable page

AI-generated from stored detector signals - the AI never visited the site. · 2026-09-06 · confidence 80%

Domain & Network

Whois

Registrar GoDaddy.com, LLC

Network

IP 3.145.232.22

Country