The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
Suspicious — review required
| URL | hxxps://jhl9vv9k[.]r[.]us-east-1[.]awstrack[.]me/L0/https:%2F%2Flogin[.]microsoftonline[.]com%2Fcommon%2Foauth2%2Fv2[.]0%2Fauthorize%3Fscope=openid%26prompt=none%26client_id=865af9bf-2634-4259-a8e3-37a7003b12f8%26state=mike[.]johnson@roadssinc[.]com/1/0100019eb84dc1cf-37ed7f88-f378-4f41-bbad-ba72cf210111-000000/1fLURlgXxT5wZ5mtgpU8-CJ3wm4=473 | |
| Host | jhl9vv9k[.]r[.]us-east-1[.]awstrack[.]me | |
| Registered domain | awstrack[.]me | |
| Scan ID | 7be43b40-5ccf-482a-8bbe-e28ac827d841 |
No brand impersonation signals available.
| Host | jhl9vv9k.r.us-east-1.awstrack.me |
| Registered domain | awstrack.me |
| Scheme | https |
| ApiFlash | transport error |
| JARM | 7937937937937938c28c28c28c2602366908fabef72f2cf3a79c7f9d962e4a |
| Redirect hops | 2 |
The fetched content is a generic “404 Not Found” page with no login form, credential collection fields, or brand-specific UI.
Although the URL path contains an encoded Microsoft login endpoint (login.microsoftonline.com / oauth2 / authorize), the server response provides only an error message: “The requested resource was not found on this server.” This strongly suggests the phishing payload did not load (or the request was blocked), so there is insufficient evidence of an active phishing flow in the HTML/OCR provided.
With no visible social-engineering elements present (no account warning, urgency cues, or form fields), the safest conservative conclusion is that this instance is not demonstrably phishing based on the retrieved content alone.
The landing page is a blank Microsoft OAuth2 /authorize endpoint with prompt=none and sso_reload=true — a silent SSO flow that intentionally renders no UI. No credential form, brand impersonation, or interactive phishing affordance is visible. However, the redirect chain reveals this originated from jhl9vv9k.r.us-east-1.awstrack.me (IP: 100.49.36.98), an AWS SES email click-tracking domain — strongly suggesting the user arrived here via a tracked phishing email link. The OAuth client_id (865af9bf-2634-4259-a8e3-37a7003b12f8) and the victim’s email in the state parameter are consistent with an illicit consent grant / OAuth phishing attack, but the current page itself is legitimate Microsoft infrastructure with no hostile content rendered.