microsoft-1ogin[.]duckdns[.]org

The domain microsoft-1ogin.duckdns.org was registered on May 17, 2026 via the DuckDNS service and is currently active. DNS resolution points to IP address 216.198.79.1, which is geolocated to the United States and associated with Lefkoff Industries. The web server presents an HTTP 308 status code and serves a TLS certificate issued by Let’s Encrypt (R13). Automated scans show the presence of Vercel hosting and HTTP Strict Transport Security (HSTS) headers. Google Safe Browsing classifies the site under the "SOCIAL_ENGINEERING" category, and 18 of 91 security vendors on VirusTotal have flagged the domain. It appears on one public blocklist and is actively blocked by PhishDestroy. The page title returned by the server is "Entrar em sua conta", indicating a likely credential‑harvesting attempt targeting Microsoft users. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. No additional page content has been observed, so the exact phishing layout remains unverified. Defenders should add the domain and its resolving IP to block lists, monitor DNS queries for related DuckDNS subdomains, and enforce multi‑factor authentication for Microsoft accounts to mitigate credential compromise. Continuous re‑evaluation is advised as threat actors may modify the payload or redirect infrastructure.