Phishing sites impersonating Microsoft

PhishDestroy has recorded 1,525 phishing domains impersonating Microsoft since 2025-07-18, 72 of them in the last 30 days. The most used registrars are Cloudflare and GoDaddy.com; the most common TLDs are .com and .app. The official Microsoft domain is microsoft.com: any other site asking for your login or wallet is not Microsoft.

1,525
Domains, all time
72
Last 30 days
809
Online at last check
248
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 52026-07-26: 02026-07-27: 72026-07-28: 22026-07-29: 32026-07-30: 102026-07-31: 52026-08-01: 82026-08-02: 52026-08-03: 72026-08-04: 52026-08-05: 52026-08-06: 52026-08-07: 32026-08-08: 42026-08-09: 32026-08-10: 42026-08-11: 42026-08-12: 62026-08-13: 42026-08-14: 52026-08-15: 92026-08-16: 32026-08-17: 12026-08-18: 42026-08-19: 02026-08-20: 142026-08-21: 52026-08-22: 82026-08-23: 42026-08-24: 12026-08-25: 92026-08-26: 22026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 72026-09-01: 72026-09-02: 32026-09-03: 72026-09-04: 62026-09-05: 12026-09-06: 32026-09-07: 12026-09-08: 62026-09-09: 62026-09-10: 02026-09-11: 92026-09-12: 12026-09-13: 02026-09-14: 12026-09-15: 82026-09-16: 22026-09-17: 52026-09-18: 02026-09-19: 12026-09-20: 32026-09-21: 02026-09-22: 02026-09-23: 32026-09-24: 02026-09-25: 142026-09-26: 32026-09-27: 42026-09-28: 02026-09-29: 62026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 12026-10-04: 02026-10-05: 02026-10-06: 72026-10-07: 42026-10-08: 22026-10-09: 52026-10-10: 22026-10-11: 52026-10-12: 02026-10-13: 42026-10-14: 12026-10-15: 12026-10-16: 02026-10-17: 32026-10-18: 12026-10-19: 22026-10-20: 22026-10-21: 22026-10-22: 0
Microsoft phishing domains detected per day: 309 from 2026-07-25 to 2026-10-22; peak 14.

How to tell a fake Microsoft site

Official domains: microsoft.com, live.com, microsoftonline.com.

Words most often added to the brand in reported domains: secure, iceiy, page, login, teams, server, office, outlook, security, mail.

  • Type the address yourself or use a bookmark; phishing links for Microsoft arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Microsoft does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Microsoft phishing domains

The 50 most recently detected domains impersonating Microsoft
DomainFirst detectedStatus at last checkRegistrar
phmacentral.info2026-10-21OnlineWild West Domains
football-outlook.com.cn2026-10-21Online北京新网数码信息技术有限公司
sharepoint.onedrive.dczhxkw84930320.passkey.auth02.outlook.drive.plastkon.cc2026-10-20OnlinePorkbun
66274-outlook.com2026-10-20OnlinePublicDomainRegistry.com
abcgil.com2026-10-19OnlinePublicDomainRegistry.com
teamlives.business2026-10-19OfflineDynadot
microsoftteam.info2026-10-18OfflineDynadot
owa-microsoft-share-com.jict.info2026-10-17OfflineNameCheap
validar-micuentafftmicros2026a.zya.me2026-10-17OnlinePorkbun
pporcionate-security.zya.me2026-10-17OnlinePorkbun
debahc.com2026-10-15OnlineInternet Domain Service BS
soilmatengineers.com2026-10-14OnlineNameSilo
login.authhmicrosoftonline.sbs2026-10-13OnlineNameSilo
microsoftupdater.info2026-10-13OnlineTurkticaret.net Yazılım Hizmetleri Sanay
qautilyplastlimited.com2026-10-13OnlineNameCheap
albertsonstore.us2026-10-13UnknownSpaceship
adminvisibilidad.serviciosmsm.com2026-10-11Online10dencehispahard SLU
ecloud4u.eu2026-10-11Onlinecyber_Folks
applyviza.net2026-10-11OfflineDNC Holdings
microsoft-sharepoint.fr2026-10-11OnlineOVH
click5.microsoftsupportcenter.digital2026-10-11OnlineNameSilo
hegards.sk2026-10-10OfflineGransy s.r.o
kinesis-ergo.mom2026-10-10OnlineDYNADOT
goldpocket.capital2026-10-09OnlineGNAME.COM
ipgrussia.run2026-10-09OnlineNameSilo
finanisweb3.cc2026-10-09OnlineGname.com
goldpocket.biz2026-10-09OnlineGname.com
allservicerents.com2026-10-09OnlineGoDaddy.com
microsoft365updates.com2026-10-08OnlineCloudflare
endomedik.com.ar2026-10-08Online—
topcirnent-sp.lat2026-10-07OnlineDynadot
eightelegance.com.br2026-10-07Online—
onmicrosoftonline-mmscrmcustomers.mm.am2026-10-07Onlineabcdomain (ABCDomain )
microsoft.empowerbydxc.com2026-10-07OnlineGoDaddy.com
outlook-office365.com2026-10-06OnlineRealtime Register
whatsappcampaign.online2026-10-06OnlineName.com
notifications.microsoft-ssl.com2026-10-06OnlineCSC Corporate Domains
microsoftuk.co2026-10-06OnlineGoDaddy.com
outlookmail.social2026-10-06OnlineAutomattic
microsoft.updata.net.cn2026-10-06OnlineGoDaddy.com
microsoft-se.us2026-10-06OnlineGoDaddy.com
reactivar-aquimx000.zya.me2026-10-03OnlinePorkbun
obl.securefileshared.info2026-09-29OnlineGoDaddy.com
outlook.evergreenfin.ltd2026-09-29UnknownNICENIC
verificarcuenta-micros0ft2026way.zya.me2026-09-29OnlinePorkbun
paeonia.gr2026-09-29Online—
secure.link-it.online2026-09-29OnlineNameCheap
teams-microsoft.co2026-09-29OnlineNICENIC
microsoft-office365.site2026-09-27OnlineCloudflare
webfun.website2026-09-27OnlineGandi

All 1,525 Microsoft reports

Where they are registered and hosted

Registrars

  1. Cloudflare123
  2. GoDaddy.com83
  3. Porkbun69
  4. CSC Corporate Domains66
  5. MarkMonitor59
  6. NameSilo58
  7. Replit49
  8. NameCheap41

Top-level domains

  1. .com604
  2. .app232
  3. .dev128
  4. .io52
  5. .net48
  6. .top26
  7. .org24
  8. .cn23

Hosting networks

  1. Cloudflare, Inc.222
  2. Amazon.com, Inc.126
  3. AMAZON-02 - Amazon.com, Inc., US96
  4. Google LLC94
  5. Microsoft Corporation75
  6. Wildcard UK Limited48
  7. WEEBLY - Weebly, Inc., US45
  8. WILDCARD-AS Wildcard UK Limited, GB39

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Microsoft; share of all PhishDestroy reports: 0.68%.