# sharepointonline-microsoft.com — DANA-branded password change page | PhishDestroy

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/sharepointonline-microsoft.com/
Machine-readable companion: https://phishdestroy.io/domain/sharepointonline-microsoft.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-29 13:40:32 UTC
- Last availability or vendor check: 2026-10-30 12:10:26 UTC
- Stored record updated: 2026-10-30 15:23:32 UTC
- VirusTotal detections in the stored snapshot: 9/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: Phishunt
- Google Safe Browsing stored result: checked_clean

## Stored labels and detections

- Automated brand label (collector metadata; not a confirmed impersonation finding): Microsoft

## Stored infrastructure

- Observed IP address: 147.139.210.106
- Registrar in stored WHOIS data: Dominet (HK) Limited
- Last stored HTTP status: 404
- Registration date in stored WHOIS data: 2025-11-21 06:24:41 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a187ec-b3ff-77d1-b8fa-7f194e6c2b75/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/sharepointonline-microsoft.com
- Certificate Transparency search: https://crt.sh/?q=%25.sharepointonline-microsoft.com
- Web Archive lookup: https://web.archive.org/web/*/https://sharepointonline-microsoft.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Public report package

The captured page on sharepointonline-microsoft.com shows a DANA-branded password change form, as reviewed by PhishDestroy.

The captured page on sharepointonline-microsoft.com presents a password change form branded with the DANA logo, showing the email raihan.adisecha@dana.id above fields for Old Password and New Password, each with a visibility toggle, followed by a Change Password button and an "omnissar" mark. The HTML title reads "Not Found," which does not match the form content shown in the screenshot.

VirusTotal's domain-scoped analysis of sharepointonline-microsoft.com flagged 9 of 92 engines (8 malicious, 1 suspicious). BitDefender labeled the domain phishing, while CRDF labeled it malicious.
Package revision: 32571fd87c26317dcfab18128b69033a6bc2e90c36517b81c61029d75d3e6537
Text generated (not scan time): 2026-10-30 02:59:03
Reviewed evidence snapshot: {"domain":"sharepointonline-microsoft.com","screenshot_available":true,"page_title":"Not Found","virustotal":{"detections":9,"engines":92,"malicious":8,"suspicious":1,"retrieved_date":"2026-10-30","analysis_date":"2026-10-29","flagging_vendors":["CRDF","DNS8","G-Data","Gridinsoft","MalwareURL","BitDefender","Chong Lua Dao","alphaMountain.ai","Forcepoint ThreatSeeker"],"vendor_labels":{"CRDF":"malicious","DNS8":"phishing","G-Data":"phishing","Gridinsoft":"suspicious","MalwareURL":"phishing","BitDefender":"phishing","Chong Lua Dao":"malicious","alphaMountain.ai":"malicious","Forcepoint ThreatSeeker":"phishing"},"scope":"domain"},"capture_context":{"relationship":"screenshot associated with this domain record","captured_at":"2026-10-29T16:30:44Z"}}
Source facts (timestamps as stored): {"record_id":1706074,"first_recorded_at":"2026-10-29 14:40:32","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":9,"denominator":92,"malicious":8,"suspicious":1,"vendors":{"CRDF":"malicious","DNS8":"phishing","G-Data":"phishing","Gridinsoft":"suspicious","MalwareURL":"phishing","BitDefender":"phishing","Chong Lua Dao":"malicious","alphaMountain.ai":"malicious","Forcepoint ThreatSeeker":"phishing"},"observed_at":"2026-10-29T12:25:39Z","checked_at":"2026-10-30 02:57:25","fetched_at":"2026-10-30T01:57:22Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":9,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","BitDefender","Chong Lua Dao","CRDF","DNS8","Forcepoint ThreatSeeker","G-Data","Gridinsoft","MalwareURL"],"observed_at":"2026-10-29 12:25:39","checked_at":"2026-10-30 02:57:25","fetched_at":"2026-10-30 01:57:26","time_basis":"as stored; legacy timezone not established"}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-10-30 02:57:30"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-10-29 16:30:21"},"availability":{"source":"stored HTTP observation","state":"alive","observed_at":"2026-10-30 13:10:26"}}

## Stored page captures

- Primary capture: https://i.ibb.co/bjrZjdkp/6a91520c48df.png
  Captured: 2026-10-29 13:51:37 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a187ec-b3ff-77d1-b8fa-7f194e6c2b75.png
  Captured: 2026-10-29 13:51:37 UTC
  Source report: https://urlscan.io/result/01a187ec-b3ff-77d1-b8fa-7f194e6c2b75/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a187c0-131b-75d3-9e59-6f6596174dda.png
  Captured: 2026-10-29 13:40:32 UTC
  Source report: https://urlscan.io/result/01a187ec-b3ff-77d1-b8fa-7f194e6c2b75/
- URLScan · 2026-10-29: https://screenshots.phishdestroy.io/us/01a187a7-9c3a-7718-9678-d246cc720ba0.png
  Captured: 2026-10-29 12:34:39 UTC
  Source report: https://urlscan.io/result/01a187a7-9c3a-7718-9678-d246cc720ba0/
  SHA-256: fa01bbb674b5ddd39495bddc5ad0ed31da1f15747dd9ea57abbd2621b1f53a74
- URLScan · 2026-10-29: https://screenshots.phishdestroy.io/us/01a187e4-3cf6-74cd-be50-f4408f561643.png
  Captured: 2026-10-29 13:41:07 UTC
  Source report: https://urlscan.io/result/01a187e4-3cf6-74cd-be50-f4408f561643/
  SHA-256: 06119836738b763a0314ee8b9de1d102eeeb5726e51599f46789bb95c74ce103
- URLScan · 2026-10-29: https://screenshots.phishdestroy.io/us/01a1887f-a813-7187-ae56-f62baa83f35d.png
  Captured: 2026-10-29 16:30:44 UTC
  Source report: https://urlscan.io/result/01a1887f-a813-7187-ae56-f62baa83f35d/
  SHA-256: 06119836738b763a0314ee8b9de1d102eeeb5726e51599f46789bb95c74ce103
- URLScan · 2026-10-30: https://screenshots.phishdestroy.io/us/01a18b33-4cbc-71ce-96f4-c064c59c23da.png
  Captured: 2026-10-30 05:06:08 UTC
  Source report: https://urlscan.io/result/01a18b33-4cbc-71ce-96f4-c064c59c23da/
  SHA-256: 06119836738b763a0314ee8b9de1d102eeeb5726e51599f46789bb95c74ce103
- URLScan · 2026-10-29: https://screenshots.phishdestroy.io/us/01a187c0-131b-75d3-9e59-6f6596174dda.png
  Captured: 2026-10-29 13:01:43 UTC
  Source report: https://urlscan.io/result/01a187c0-131b-75d3-9e59-6f6596174dda/
  SHA-256: 06119836738b763a0314ee8b9de1d102eeeb5726e51599f46789bb95c74ce103

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-29T14:11:20Z",
        "uuid": "01a187ec-b3ff-77d1-b8fa-7f194e6c2b75",
        "scanned_at": "2026-10-29T13:50:06Z",
        "final_url": "http://sharepointonline-microsoft.com/",
        "status": 200,
        "redirects": [
            {
                "to": "https://sharepointonline-microsoft.com/",
                "from": "http://sharepointonline-microsoft.com/",
                "status": 307
            },
            {
                "to": "http://sharepointonline-microsoft.com/",
                "from": "https://sharepointonline-microsoft.com/",
                "status": 307
            }
        ],
        "ip": "147.139.210.106",
        "domains": [
            "edik.jp.wss.workspaceone.com"
        ],
        "ips": [
            "99.83.218.200",
            "147.139.210.106"
        ],
        "asns": [
            "16509",
            "45102"
        ],
        "countries": [
            "US",
            "ID"
        ],
        "doc_hash": "04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747",
        "globals": [
            "oldPw",
            "newPw",
            "signIn",
            "updateSignIn"
        ],
        "cookies": [
            "AWSALBCORS"
        ],
        "domain_age_days": 981,
        "apex_age_days": 981,
        "requests": 12,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "image/png"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-29T13:46:40Z",
        "uuid": "14cdab4b-8a0a-4844-9d60-5dbd5164d843",
        "scanned_at": "2026-10-29T13:40:55Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-30T01:57:22Z",
        "analysis_at": "2026-10-29T12:25:39Z",
        "stats": {
            "timeout": 0,
            "harmless": 50,
            "malicious": 8,
            "suspicious": 1,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "phishing",
            "G-Data": "phishing",
            "Gridinsoft": "suspicious",
            "MalwareURL": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2025-11-21T00:00:00Z",
        "updated": "2025-11-21T00:00:00Z",
        "first_seen": "2024-02-22T08:09:51Z",
        "dns": [
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "hostmaster.hichina.com",
                "value": "ns7.alidns.com"
            },
            {
                "ttl": 600,
                "type": "MX",
                "value": "mxdm-ap-southeast-1.aliyun.com",
                "priority": 1
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "147.139.210.106"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns7.alidns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns8.alidns.com"
            },
            {
                "ttl": 600,
                "type": "TXT",
                "value": "v=spf1 include:spfdm-ap-southeast-1.aliyun.com -all"
            }
        ],
        "dns_at": "2026-10-29T12:30:58Z",
        "jarm": "2ad2ad0002ad2ad22c2ad2ad2ad2adce7a321e4956e8298ba917e9f2c22849",
        "cert": {
            "issuer": "Qjvoobim / Koqnu",
            "serial": "117dfb9d308a514b7882782f7af534b5ee759117",
            "sha256": "cba86af4cb19f89f2383c70c9fa725a8dd01784929ae6001c29d27f17a189373",
            "subject": "Koqnu",
            "valid_to": "2031-10-27T00:49:58Z",
            "valid_from": "2021-10-29T00:49:58Z"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2026-11-21T07:24:41Z",
                "registration": "2025-11-21T07:24:41Z",
                "registrar expiration": "2026-11-21T07:24:41Z",
                "last update of RDAP database": "2025-11-21T07:24:42Z"
            },
            "registrar": "Dominet (HK)Limited",
            "registrar_iana_id": "3775"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-29T13:41:50Z",
        "mail_config": {
            "mx": [
                "mxdm-ap-southeast-1.aliyun.com"
            ],
            "spf": "v=spf1 include:spfdm-ap-southeast-1.aliyun.com -all",
            "dmarc": true,
            "spf_lookups": 3
        },
        "caa_records": {
            "domain": "sharepointonline-microsoft.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2024-09-08T07:55:45Z",
            "first": "2024-05-02T23:33:52Z",
            "changes": 2,
            "days_archived": 3,
            "scans_per_day": 0.02,
            "avg_page_bytes": 2859
        },
        "ports": {
            "open": [
                80,
                8888
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "39.96.153.47",
                    "host": "ns7.alidns.com"
                },
                {
                    "ip": "47.118.199.208",
                    "host": "ns8.alidns.com"
                }
            ],
            "zone": "sharepointonline-microsoft.com"
        },
        "location": {
            "ip": "147.139.210.106",
            "asn": "45102",
            "org": "Alibaba Cloud LLC",
            "city": "Jakarta",
            "country": "ID"
        },
        "dns": {
            "A": [
                "147.139.210.106"
            ],
            "MX": [
                "{\"exchange\": \"mxdm-ap-southeast-1.aliyun.com\", \"priority\": 1}"
            ],
            "NS": [
                "ns7.alidns.com",
                "ns8.alidns.com"
            ],
            "SOA": "{\"nsname\": \"ns7.alidns.com\", \"hostmaster\": \"hostmaster.hichina.com\", \"serial\": 2026082617, \"refresh\": 3600, \"retry\": 1200, \"expire\": 86400, \"minttl\": 600}",
            "TXT": [
                "v=spf1 include:spfdm-ap-southeast-1.aliyun.com -all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "147.139.210.106",
            "family": 4
        },
        "whois": {
            "registrar": "Dominet (HK) Limited",
            "created": "2025-11-21T07:24:41Z",
            "updated": "2025-11-21T07:24:41Z",
            "expires": "2026-11-21T07:24:41Z",
            "status": [
                "ok https://icann.org/epp"
            ],
            "nameservers": [
                "ns7.alidns.com",
                "ns8.alidns.com"
            ]
        }
    }
}
```