Phishing detection: office365thunderbirdconfiguration.pages.dev

Microsoft
https://office365thunderbirdconfiguration.pages.dev Access site
Screenshot
No screenshot available yet Captured automatically on the next refresh cycle
Investigate
Domain office365thunderbirdconfiguration.pages.dev1 CT host on apex
urlscan page.domain VirusTotal Whois
IP 172.66.44.144
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://office365thunderbirdconfiguration.pages.dev
urlscan Wayback archive.today
Cert Google Trust Services
crt.sh Censys Google CT
Phishunt analysis Beta
21 low suspicionheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +5.1 urlscan.io
  • +1.1 ASN reputation
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.6 Long domain
  • +0.6 Suspicious TLD
  • +0.5 Young certificate
  • +0.3 Free CA
  • +0.1 Deep subdomain
14 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Site impersonates Microsoft Office 365, using a Cloudflare Pages subdomain referencing both Office 365 and Thunderbird to target email credential theft. No genuine Microsoft outlinks are present. Flagged malicious by urlscan.

Keyword matchPaaS hosturlscan.io
AI-generated from stored detector signals - the AI never visited the site. · 2026-08-20 · confidence 55%
Domain & Network
Whois
Registrar CloudFlare, Inc.
Network
IP 172.66.44.144
Country United StatesUnited States
Hosting Cloudflare, Inc.
ASN AS13335
TLS Cert Google Trust Services
External detection urlscan.io
CleanGoogle Safe Browsing · OpenPhish · PhishTank · TweetFeed
Report this phishing
PaaS platform Cloudflare Pages
Web form
Registrar CloudFlare, Inc.
registrar-abuse@cloudflare.com
Brand owner Microsoft
phish@office365.microsoft.com Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-08-19 22:23 UTC  ·  Last refreshed 2026-08-23 07:30 UTC