keyforgeonline[.]com

PhishDestroy identifies keyforgeonline.com as an active credential phishing domain designed to harvest Microsoft 365 login credentials. The threat level is marked as 'under_investigation' due to ongoing behavioral analysis, but indicators strongly suggest a high-risk campaign targeting enterprise users. This domain mimics legitimate Microsoft authentication portals to deceive victims into surrendering sensitive credentials, making it a critical threat for organizations relying on Microsoft cloud services.

This domain was flagged after being created on March 12, 2026, and resolving to IP address 159.195.9.211. It utilizes a Let's Encrypt SSL certificate (common among phishing sites to appear legitimate) and is registered through HOSTINGER operations, UAB. Despite zero detections on VirusTotal (4/95), the domain’s recent registration, hosting infrastructure, and SSL configuration align with known phishing toolkits. No current blocklist entries were detected at the time of assessment, though this may change as threat intelligence evolves.

Users and organizations should immediately block access to keyforgeonline.com at the network level and avoid visiting the site. If credentials were entered, revoke access for the compromised account in Microsoft 365’s admin center and enforce password resets. Enable multi-factor authentication (MFA) as an additional safeguard. Report the domain to Microsoft’s phishing reporting tool and your organization’s security team. Monitor for unusual login attempts or data exfiltration patterns linked to this campaign.