# index-html-btos.onrender.com Microsoft sign-in page | PhishDestroy
Content language: English
Canonical HTML report: https://phishdestroy.io/domain/index-html-btos.onrender.com/
Machine-readable companion: https://phishdestroy.io/domain/index-html-btos.onrender.com/llm.txt
## Summary
PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.
## Stored observations
- Listed by PhishDestroy: yes
- Availability at last stored check: Last known active
- First observed by PhishDestroy: 2026-10-23 00:13:00 UTC
- Selected availability observation: 2026-11-11T03:45:53Z
- Stored record updated: 2026-11-11 03:45:53 UTC
- VirusTotal detections in the stored snapshot: 14/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: checked_clean
## Stored labels and detections
- Automated brand label (collector metadata; not a confirmed impersonation finding): outlook
## Stored infrastructure
- Observed IP address: 216.24.57.16
- Registrar in stored WHOIS data: Render Services Inc.
- Last stored HTTP status: 200 (observed: 2026-11-11T03:45:53Z)
- Registration date (registry RDAP, onrender.com): 2015-03-28 01:20:58 UTC
## Evidence links
- URLScan report: https://urlscan.io/result/01a16619-4244-715f-9651-26d0bde2b1b1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/index-html-btos.onrender.com
- Certificate Transparency search: https://crt.sh/?q=%25.index-html-btos.onrender.com
- Web Archive lookup: https://web.archive.org/web/*/https://index-html-btos.onrender.com/
## Corrections
- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq
## Public report package
The stored capture of index-html-btos.onrender.com shows a Microsoft-branded sign-in page, reviewed by PhishDestroy for phishing indicators.
The stored capture shows a Microsoft-branded sign-in card in French, headed "Se connecter" and asking users to continue to Outlook to view a document. It provides an email field for Outlook, Live or Hotmail addresses and a "Suivant" button to proceed, plus links to create an account or recover access. The page claims Microsoft and Outlook identity; the domain index-html-btos.onrender.com is not an official Microsoft domain.
The stored VirusTotal result reports 14 of 92 engines flagged this domain, with 14 malicious and 0 suspicious detections. Representative labels include ESET and Sophos as "phishing" and Webroot as "malicious". PhishDestroy records this result for reference; a scanner verdict alone does not establish impersonation or current behavior.
Package revision: 83415b28e4e4331d9c7df001c1ae3505cab7bbb5309ce7addae12b8c160e68cc
Text generated (not scan time): 2026-10-29 03:50:01
Reviewed evidence snapshot: {"domain":"index-html-btos.onrender.com","screenshot_available":true,"page_title":"home","initial_ai_description":"The page impersonates Microsoft and Outlook, prompting users to 'Se connecter' (log in) to view a document, which is a common credential theft tactic. The domain 'index-html-btos.onrender.com' is not an official Microsoft domain.","initial_ai_description_kind":"previous AI opinion, not independent evidence","virustotal":{"detections":14,"engines":92,"malicious":14,"suspicious":0,"retrieved_date":"2026-10-23","analysis_date":"2026-10-14","flagging_vendors":["DNS8","ESET","VIPRE","G-Data","Lionic","Sophos","CyRadar","Webroot","Fortinet","SOCRadar","Gridinsoft","MalwareURL","BitDefender","alphaMountain.ai"],"vendor_labels":{"DNS8":"phishing","ESET":"phishing","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Fortinet":"phishing","SOCRadar":"phishing","Gridinsoft":"phishing","MalwareURL":"phishing","BitDefender":"phishing","alphaMountain.ai":"phishing"},"scope":"domain"},"capture_context":{"relationship":"screenshot associated with this domain record","captured_at":"2026-10-22T20:12:18Z"}}
Source facts (timestamps as stored): {"record_id":1636317,"first_recorded_at":"2026-10-23 02:13:00","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":14,"denominator":92,"malicious":14,"suspicious":0,"vendors":{"DNS8":"phishing","ESET":"phishing","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Fortinet":"phishing","SOCRadar":"phishing","Gridinsoft":"phishing","MalwareURL":"phishing","BitDefender":"phishing","alphaMountain.ai":"phishing"},"observed_at":"2026-10-14T05:48:31Z","checked_at":null,"fetched_at":"2026-10-23T00:55:05Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":14,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","BitDefender","CyRadar","DNS8","ESET","Fortinet","G-Data","Gridinsoft","Lionic","MalwareURL","SOCRadar","Sophos","VIPRE","Webroot"],"observed_at":"2026-10-14 05:48:31","checked_at":"2026-10-25 04:00:28","fetched_at":"2026-10-25 03:00:29","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"DNS8":"phishing","ESET":"phishing","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Fortinet":"phishing","SOCRadar":"phishing","Gridinsoft":"phishing","MalwareURL":"phishing","BitDefender":"phishing","alphaMountain.ai":"phishing"},"vendor_names":["DNS8","ESET","VIPRE","G-Data","Lionic","Sophos","CyRadar","Webroot","Fortinet","SOCRadar","Gridinsoft","MalwareURL","BitDefender","alphaMountain.ai"],"stats":{"timeout":0,"harmless":48,"malicious":14,"suspicious":0,"undetected":30}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-04 18:02:13"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-10-23 04:31:30"},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1636317,"scope":"checked_url","observed_at":"2026-11-11T03:45:53Z","http_status":200,"http_observed_at":"2026-11-11T03:45:53Z","stored_http_code":200,"stored_http_observed_at":"2026-11-11T03:45:53Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"served_at_root","content_classification_at":"2026-11-10T23:27:14Z","registration_state":"unknown","policy":"20261102-dated-availability-v2"}}
## Stored page captures
- Stored capture: https://i.ibb.co/Jjtm0LBD/fa6548916b57.png
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/01a16619-4244-715f-9651-26d0bde2b1b1.png
Captured: 2026-10-23 00:11:39 UTC
Source report: https://urlscan.io/result/01a16619-4244-715f-9651-26d0bde2b1b1/
- URLQuery: https://screenshots.phishdestroy.io/uq/c7e8943a-c2e4-454e-9f32-b6f31387238c.png
Captured: 2026-10-25 12:41:02 UTC
Source report: https://urlquery.net/report/c7e8943a-c2e4-454e-9f32-b6f31387238c
SHA-256: b655da658546a45f221f5589f3def6bd50cc469b168b6775d75cc1c3d03f4acb
- URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a11653-00c0-72cf-b359-4b8df8be02b4.png
Captured: 2026-10-07 12:25:07 UTC
Source report: https://urlscan.io/result/01a11653-00c0-72cf-b359-4b8df8be02b4/
SHA-256: ccf82b1ab36c464f60e85a5ea7bdb1fe5321e2c9b222ee158ab3c2aa0b478607
- URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a11677-0ac3-741a-bf52-0147d5c8f12d.png
Captured: 2026-10-07 13:04:28 UTC
Source report: https://urlscan.io/result/01a11677-0ac3-741a-bf52-0147d5c8f12d/
SHA-256: 9c8e74759476cce3cf6850771be05cba9ca322ea27f47b5e1327b4c38fe8122d
- URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a11743-3337-7159-ab38-adeeb1e774b2.png
Captured: 2026-10-07 16:47:28 UTC
Source report: https://urlscan.io/result/01a11743-3337-7159-ab38-adeeb1e774b2/
SHA-256: 9c8e74759476cce3cf6850771be05cba9ca322ea27f47b5e1327b4c38fe8122d
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a1653e-1e90-71dc-ae3b-a65d3f111142.png
Captured: 2026-10-22 20:12:18 UTC
Source report: https://urlscan.io/result/01a1653e-1e90-71dc-ae3b-a65d3f111142/
SHA-256: 9c8e74759476cce3cf6850771be05cba9ca322ea27f47b5e1327b4c38fe8122d
## Collected source observations
Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
"urlscan": {
"v": 1,
"fetched_at": "2026-10-23T00:35:13Z",
"uuid": "01a16619-4244-715f-9651-26d0bde2b1b1",
"scanned_at": "2026-10-23T00:11:39Z",
"final_url": "https://index-html-btos.onrender.com/connexion.html",
"status": 200,
"redirected": "https-only",
"redirects": [
{
"to": "https://index-html-btos.onrender.com/connexion.html",
"from": "http://index-html-btos.onrender.com/connexion.html",
"status": 307
}
],
"ip": "216.24.57.18",
"ptr": "ip-216-24-57-18.ingress.render.com",
"domains": [
"logincdn.msauth.net"
],
"ips": [
"216.24.57.18"
],
"asns": [
"397273"
],
"countries": [
"US"
],
"doc_hash": "7d180c3b69b02b12b519b9215a4a6c9e9fe803e452f0dee0801c76b18dafbfd6",
"globals": [
"a",
"b",
"c",
"firstAttempt"
],
"tls": {
"san": [
"onrender.com",
"*.onrender.com"
],
"cipher": "AES_128_GCM",
"issuer": "WE1",
"subject": "onrender.com",
"protocol": "TLS 1.3",
"valid_to": "2026-12-20T23:04:28Z",
"valid_from": "2026-09-21T22:04:31Z"
},
"domain_age_days": 15,
"apex_age_days": 15,
"tls_age_days": 31,
"tls_valid_days": 90,
"requests": 3,
"verdicts": {
"engines": {
"tags": [
"urlscan-ml",
"urlscan-ml-60c5e22"
],
"score": 100,
"malicious": true
},
"overall": {
"tags": [
"phishing"
],
"score": 100,
"brands": [
"microsoft"
],
"malicious": true,
"categories": [
"phishing"
]
},
"urlscan": {
"tags": [
"phishing"
],
"score": 100,
"brands": [
"Microsoft"
],
"malicious": true,
"categories": [
"phishing"
]
}
},
"headers": {
"server": "cloudflare",
"content-type": "text/html; charset=utf-8",
"strict-transport-security": "max-age=315360000; includeSubdomains; preload",
"x-content-type-options": "nosniff"
}
},
"vt": {
"v": 1,
"fetched_at": "2026-10-23T00:55:05Z",
"analysis_at": "2026-10-14T05:48:31Z",
"stats": {
"timeout": 0,
"harmless": 48,
"malicious": 14,
"suspicious": 0,
"undetected": 30
},
"detections": {
"DNS8": "phishing",
"ESET": "phishing",
"VIPRE": "phishing",
"G-Data": "phishing",
"Lionic": "phishing",
"Sophos": "phishing",
"CyRadar": "phishing",
"Webroot": "malicious",
"Fortinet": "phishing",
"SOCRadar": "phishing",
"Gridinsoft": "phishing",
"MalwareURL": "phishing",
"BitDefender": "phishing",
"alphaMountain.ai": "phishing"
},
"reputation": 0,
"tags": [
"dga"
],
"categories": {
"alphaMountain.ai": "Phishing (alphaMountain.ai)"
},
"registrar": "Amazon Registrar, Inc.",
"created": "2015-03-28T01:20:58Z",
"expires": "2027-03-28T01:20:58Z",
"updated": "2026-05-15T17:25:02Z",
"first_seen": "2026-09-30T14:05:27Z",
"dns": [
{
"ttl": 300,
"type": "CNAME",
"value": "gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net"
},
{
"ttl": 300,
"type": "CNAME",
"value": "gcp-us-west1-1.origin.onrender.com"
},
{
"ttl": 300,
"type": "A",
"value": "216.24.57.16"
},
{
"ttl": 300,
"type": "A",
"value": "216.24.57.18"
}
],
"dns_at": "2026-10-14T05:48:53Z",
"jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
"cert": {
"san": [
"onrender.com",
"*.onrender.com"
],
"issuer": "Google Trust Services / WE1",
"serial": "6eb1e3fe7d0631ea1337bfa4a321c137",
"sha256": "a88cf8e12b2e731a485d320c92b48ea71e0d6bf8a83868b5d110da51d4a1a45c",
"subject": "onrender.com",
"valid_to": "2026-12-20T23:04:28Z",
"valid_from": "2026-09-21T22:04:31Z"
},
"whois": {
"registrar": "Amazon Registrar, Inc.",
"registrar_iana_id": "468",
"registrar_url": "http://registrar.amazon.com",
"created": "2015-03-28T01:20:58Z",
"updated": "2026-05-15T17:25:02Z",
"expires": "2027-03-28T01:20:58Z",
"status": [
"clientTransferProhibited"
],
"nameservers": [
"ns-1324.awsdns-37.org",
"ns-1829.awsdns-36.co.uk",
"ns-245.awsdns-30.com",
"ns-813.awsdns-37.net"
],
"dnssec": "unsigned"
}
},
"webcheck": {
"v": 1,
"fetched_at": "2026-10-23T10:15:01Z",
"mail_config": {
"spf_lookups": 0
},
"caa_records": {
"count": 7,
"domain": "onrender.com",
"issuers": [
"pki.goog; cansignhttpexchanges=yes",
"digicert.com",
"letsencrypt.org"
]
},
"block_lists": {
"resolvers": 12,
"blocked_by": [
"CloudFlare Family"
],
"blocked_count": 1
},
"social_tags": {
"title": "Home"
},
"trackers": {
"requests": 4,
"trackers": [
{
"name": "Google Fonts",
"company": "Google",
"country": "US",
"category": "Hosting",
"requests": 1
},
{
"name": "Google Static",
"company": "Google",
"country": "US",
"category": "Hosting",
"requests": 1
}
]
},
"mixed_content": {
"third_party_scripts": 0
},
"status": {
"up": true,
"code": 200,
"timings": {
"dns": 8,
"tls": 18,
"wait": 239,
"connect": 10,
"download": 0
},
"response_ms": 275
},
"tls_connection": {
"alpn": "h2",
"cipher": "TLS_AES_256_GCM_SHA384",
"protocol": "TLSv1.3",
"versions": [
"TLSv1.2",
"TLSv1.3"
],
"authorized": true,
"forward_secrecy": true
},
"ports": {
"open": [
80,
443,
8080
]
},
"carbon": {
"bytes": 12020,
"co2_grams": 0.0004,
"cleaner_than": 68
},
"dns_server": {
"ns": [
{
"ip": "205.251.197.44",
"host": "ns-1324.awsdns-37.org"
},
{
"ip": "205.251.199.37",
"host": "ns-1829.awsdns-36.co.uk"
},
{
"ip": "205.251.192.245",
"host": "ns-245.awsdns-30.com"
},
{
"ip": "205.251.195.45",
"host": "ns-813.awsdns-37.net"
}
],
"zone": "onrender.com"
},
"location": {
"ip": "216.24.57.18",
"asn": "397273",
"org": "Render",
"city": "San Francisco",
"country": "US"
},
"ssl": {
"issuer": "Google Trust Services / WE1",
"subject": "onrender.com"
},
"dns": {
"A": [
"216.24.57.18",
"216.24.57.16"
],
"CNAME": [
"gcp-us-west1-1.origin.onrender.com"
]
},
"dnssec": {
"ds": false,
"rrsig": false,
"dnskey": true
},
"hsts": {
"header": "max-age=315360000; includeSubdomains; preload",
"message": "Site is compatible with the HSTS preload list!",
"compatible": true
},
"http_security": {
"xFrameOptions": false,
"referrerPolicy": false,
"xXSSProtection": false,
"permissionsPolicy": false,
"xContentTypeOptions": "nosniff",
"contentSecurityPolicy": false,
"strictTransportPolicy": "max-age=315360000; includeSubdomains; preload",
"crossOriginOpenerPolicy": false,
"crossOriginEmbedderPolicy": false,
"crossOriginResourcePolicy": false
},
"firewall": {
"waf": "Cloudflare",
"has_waf": true
},
"get_ip": {
"ip": "216.24.57.16",
"family": 4
},
"redirects": {
"chain": [
"https://index-html-btos.onrender.com"
]
},
"tech_stack": {
"technologies": [
"Google Font API",
"HSTS",
"Cloudflare",
"HTTP/3"
]
},
"headers": {
"headers": {
"server": "cloudflare",
"content-type": "text/html; charset=utf-8",
"strict-transport-security": "max-age=315360000; includeSubdomains; preload",
"x-content-type-options": "nosniff"
}
}
}
}
```
Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/us/01a1653e-1e90-71dc-ae3b-a65d3f111142.png","source":"URLScan","report_url":"https://urlscan.io/result/01a1653e-1e90-71dc-ae3b-a65d3f111142/","captured_at":"2026-10-22T20:12:18Z","sha256":"9c8e74759476cce3cf6850771be05cba9ca322ea27f47b5e1327b4c38fe8122d","model_image_sha256":"45223cedb4d8cdfc61538dad5157f44975d587f2d2009d62cdddf6b79e8c0e5c","available":true,"content_status":null}
## Complete dated records
Availability observations: https://phishdestroy.io/domain/index-html-btos.onrender.com/records.json?source=availability&format=json
Source observation history: https://phishdestroy.io/domain/index-html-btos.onrender.com/records.json?source=detections&format=json
PhishStats records: https://phishdestroy.io/domain/index-html-btos.onrender.com/records.json?source=phishstats&format=json
Sent report records: https://phishdestroy.io/domain/index-html-btos.onrender.com/records.json?source=sent_reports&format=json
Report history: https://phishdestroy.io/domain/index-html-btos.onrender.com/records.json?source=report_history&format=json
Repeat report records: https://phishdestroy.io/domain/index-html-btos.onrender.com/records.json?source=rereports&format=json
Follow-up records: https://phishdestroy.io/domain/index-html-btos.onrender.com/records.json?source=followups&format=json
Content observations: https://phishdestroy.io/domain/index-html-btos.onrender.com/records.json?source=content&format=json
## Dated availability observation
Latest stored reachability observation
```json
{
"state": "alive",
"label_key": "availability.active",
"detail_key": "detail.latest_reachability",
"params": [],
"source": "current_http_probe",
"record_id": 1636317,
"scope": "checked_url",
"observed_at": "2026-11-11T03:45:53Z",
"http_status": 200,
"http_observed_at": "2026-11-11T03:45:53Z",
"stored_http_code": 200,
"stored_http_observed_at": "2026-11-11T03:45:53Z",
"legacy_site_status": "alive",
"supports_outcome_badge": false,
"content_classification": "served_at_root",
"content_classification_at": "2026-11-10T23:27:14Z",
"registration_state": "unknown",
"policy": "20261102-dated-availability-v2"
}
```