www.znzfgdld.login.microsoftonline-billing-verification-secured-help.51-254-125-38.cpanel.site

https://www.www.znzfgdld.login.microsoftonline-billing-verification-secured-help.51-254-125-38.cpanel.site Access site

Screenshot

Investigate

Domain www.www.znzfgdld.login.microsoftonline-billing-verification-secured-help.51-254-125-38.cpanel.site48 CT hosts on apex

urlscan

page.domain

VirusTotal

Whois

IP 51.254.125.38

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL https://www.www.znzfgdld.login.microsoftonline-billing-veri…

urlscan

Wayback

archive.today

Cert YE1

crt.sh

Censys

Google CT

Phishunt analysis Beta

28 low suspicionheuristic risk score · not a probability

Why?

+6.1 Google Safe Browsing
+5.3 Keyword match
+5.1 Site cluster
+2.2 Country mismatch
+2.0 ASN reputation
+1.1 No CSP header
+1.1 No HSTS header
+0.9 Young certificate
+0.7 Brand in cert SAN
+0.7 Unrecognised DNS provider
+0.6 Long domain
+0.6 Login text in screenshot
+0.6 Deep subdomain
+0.6 Suspicious TLD
+0.4 Hyphens
+0.3 Free CA

18 signals fired · detector v3.0.0

AI analysis AIBeta

Credential harvesting

Microsoft login phishing on a very long, multi-level cpanel.site hostname containing 'microsoftonline billing verification' wording. Flagged by Google Safe Browsing; the certificate names the brand. Likely harvests Microsoft account credentials. Hosted on OVH in France.

Google Safe BrowsingLogin text in screenshotBrand in cert SAN

AI-generated from stored detector signals - the AI never visited the site. · 2026-10-17 · confidence 85%

Domain & Network

Whois

Registrar Tucows Domains Inc.

Network

IP 51.254.125.38

Country