# Phishing sites impersonating Microsoft

PhishDestroy has recorded 1,525 phishing domains impersonating Microsoft since 2025-07-18, 72 of them in the last 30 days. The most used registrars are Cloudflare and GoDaddy.com; the most common TLDs are .com and .app. The official Microsoft domain is microsoft.com: any other site asking for your login or wallet is not Microsoft.

1,525Domains, all time

72Last 30 days

809Online at last check

248Confirmed takedowns

## New domains in the last 90 days

Microsoft phishing domains detected per day: 309 from 2026-07-25 to 2026-10-22; peak 14.

## How to tell a fake Microsoft site

Official domains: microsoft.com, live.com, microsoftonline.com.

Words most often added to the brand in reported domains: secure, iceiy, page, login, teams, server, office, outlook, security, mail.
- Type the address yourself or use a bookmark; phishing links for Microsoft arrive through ads, search results, direct messages and fake support accounts.
- Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
- Microsoft does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check).

## Latest Microsoft phishing domains

The 50 most recently detected domains impersonating Microsoft
Domain | First detected | Status at last check | Registrar | 
[phmacentral.info](https://phishdestroy.io/domain/phmacentral.info/) | 2026-10-21 | Online | Wild West Domains | 
[football-outlook.com.cn](https://phishdestroy.io/domain/football-outlook.com.cn/) | 2026-10-21 | Online | 北京新网数码信息技术有限公司 | 
[sharepoint.onedrive.dczhxkw84930320.passkey.auth02.outlook.drive.plastkon.cc](https://phishdestroy.io/domain/sharepoint.onedrive.dczhxkw84930320.passkey.auth02.outlook.drive.plastkon.cc/) | 2026-10-20 | Online | Porkbun | 
[66274-outlook.com](https://phishdestroy.io/domain/66274-outlook.com/) | 2026-10-20 | Online | PublicDomainRegistry.com | 
[abcgil.com](https://phishdestroy.io/domain/abcgil.com/) | 2026-10-19 | Online | PublicDomainRegistry.com | 
[teamlives.business](https://phishdestroy.io/domain/teamlives.business/) | 2026-10-19 | Offline | Dynadot | 
[microsoftteam.info](https://phishdestroy.io/domain/microsoftteam.info/) | 2026-10-18 | Offline | Dynadot | 
[owa-microsoft-share-com.jict.info](https://phishdestroy.io/domain/owa-microsoft-share-com.jict.info/) | 2026-10-17 | Offline | NameCheap | 
[validar-micuentafftmicros2026a.zya.me](https://phishdestroy.io/domain/validar-micuentafftmicros2026a.zya.me/) | 2026-10-17 | Online | Porkbun | 
[pporcionate-security.zya.me](https://phishdestroy.io/domain/pporcionate-security.zya.me/) | 2026-10-17 | Online | Porkbun | 
[debahc.com](https://phishdestroy.io/domain/debahc.com/) | 2026-10-15 | Online | Internet Domain Service BS | 
[soilmatengineers.com](https://phishdestroy.io/domain/soilmatengineers.com/) | 2026-10-14 | Online | NameSilo | 
[login.authhmicrosoftonline.sbs](https://phishdestroy.io/domain/login.authhmicrosoftonline.sbs/) | 2026-10-13 | Online | NameSilo | 
[microsoftupdater.info](https://phishdestroy.io/domain/microsoftupdater.info/) | 2026-10-13 | Online | Turkticaret.net Yazılım Hizmetleri Sanay | 
[qautilyplastlimited.com](https://phishdestroy.io/domain/qautilyplastlimited.com/) | 2026-10-13 | Online | NameCheap | 
[albertsonstore.us](https://phishdestroy.io/domain/albertsonstore.us/) | 2026-10-13 | Unknown | Spaceship | 
[adminvisibilidad.serviciosmsm.com](https://phishdestroy.io/domain/adminvisibilidad.serviciosmsm.com/) | 2026-10-11 | Online | 10dencehispahard SLU | 
[ecloud4u.eu](https://phishdestroy.io/domain/ecloud4u.eu/) | 2026-10-11 | Online | cyber_Folks | 
[applyviza.net](https://phishdestroy.io/domain/applyviza.net/) | 2026-10-11 | Offline | DNC Holdings | 
[microsoft-sharepoint.fr](https://phishdestroy.io/domain/microsoft-sharepoint.fr/) | 2026-10-11 | Online | OVH | 
[click5.microsoftsupportcenter.digital](https://phishdestroy.io/domain/click5.microsoftsupportcenter.digital/) | 2026-10-11 | Online | NameSilo | 
[hegards.sk](https://phishdestroy.io/domain/hegards.sk/) | 2026-10-10 | Offline | Gransy s.r.o | 
[kinesis-ergo.mom](https://phishdestroy.io/domain/kinesis-ergo.mom/) | 2026-10-10 | Online | DYNADOT | 
[goldpocket.capital](https://phishdestroy.io/domain/goldpocket.capital/) | 2026-10-09 | Online | GNAME.COM | 
[ipgrussia.run](https://phishdestroy.io/domain/ipgrussia.run/) | 2026-10-09 | Online | NameSilo | 
[finanisweb3.cc](https://phishdestroy.io/domain/finanisweb3.cc/) | 2026-10-09 | Online | Gname.com | 
[goldpocket.biz](https://phishdestroy.io/domain/goldpocket.biz/) | 2026-10-09 | Online | Gname.com | 
[allservicerents.com](https://phishdestroy.io/domain/allservicerents.com/) | 2026-10-09 | Online | GoDaddy.com | 
[microsoft365updates.com](https://phishdestroy.io/domain/microsoft365updates.com/) | 2026-10-08 | Online | Cloudflare | 
[endomedik.com.ar](https://phishdestroy.io/domain/endomedik.com.ar/) | 2026-10-08 | Online | — | 
[topcirnent-sp.lat](https://phishdestroy.io/domain/topcirnent-sp.lat/) | 2026-10-07 | Online | Dynadot | 
[eightelegance.com.br](https://phishdestroy.io/domain/eightelegance.com.br/) | 2026-10-07 | Online | — | 
[onmicrosoftonline-mmscrmcustomers.mm.am](https://phishdestroy.io/domain/onmicrosoftonline-mmscrmcustomers.mm.am/) | 2026-10-07 | Online | abcdomain (ABCDomain ) | 
[microsoft.empowerbydxc.com](https://phishdestroy.io/domain/microsoft.empowerbydxc.com/) | 2026-10-07 | Online | GoDaddy.com | 
[outlook-office365.com](https://phishdestroy.io/domain/outlook-office365.com/) | 2026-10-06 | Online | Realtime Register | 
[whatsappcampaign.online](https://phishdestroy.io/domain/whatsappcampaign.online/) | 2026-10-06 | Online | Name.com | 
[notifications.microsoft-ssl.com](https://phishdestroy.io/domain/notifications.microsoft-ssl.com/) | 2026-10-06 | Online | CSC Corporate Domains | 
[microsoftuk.co](https://phishdestroy.io/domain/microsoftuk.co/) | 2026-10-06 | Online | GoDaddy.com | 
[outlookmail.social](https://phishdestroy.io/domain/outlookmail.social/) | 2026-10-06 | Online | Automattic | 
[microsoft.updata.net.cn](https://phishdestroy.io/domain/microsoft.updata.net.cn/) | 2026-10-06 | Online | GoDaddy.com | 
[microsoft-se.us](https://phishdestroy.io/domain/microsoft-se.us/) | 2026-10-06 | Online | GoDaddy.com | 
[reactivar-aquimx000.zya.me](https://phishdestroy.io/domain/reactivar-aquimx000.zya.me/) | 2026-10-03 | Online | Porkbun | 
[obl.securefileshared.info](https://phishdestroy.io/domain/obl.securefileshared.info/) | 2026-09-29 | Online | GoDaddy.com | 
[outlook.evergreenfin.ltd](https://phishdestroy.io/domain/outlook.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | 
[verificarcuenta-micros0ft2026way.zya.me](https://phishdestroy.io/domain/verificarcuenta-micros0ft2026way.zya.me/) | 2026-09-29 | Online | Porkbun | 
[paeonia.gr](https://phishdestroy.io/domain/paeonia.gr/) | 2026-09-29 | Online | — | 
[secure.link-it.online](https://phishdestroy.io/domain/secure.link-it.online/) | 2026-09-29 | Online | NameCheap | 
[teams-microsoft.co](https://phishdestroy.io/domain/teams-microsoft.co/) | 2026-09-29 | Online | NICENIC | 
[microsoft-office365.site](https://phishdestroy.io/domain/microsoft-office365.site/) | 2026-09-27 | Online | Cloudflare | 
[webfun.website](https://phishdestroy.io/domain/webfun.website/) | 2026-09-27 | Online | Gandi | 

[All 1,525 Microsoft reports](https://phishdestroy.io/domain/?brand=Microsoft)

## Where they are registered and hosted

### Registrars

- Cloudflare123
- [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)83
- [Porkbun](https://phishdestroy.io/registrar/porkbun/)69
- CSC Corporate Domains66
- [MarkMonitor](https://phishdestroy.io/registrar/markmonitor/)59
- [NameSilo](https://phishdestroy.io/registrar/namesilo/)58
- Replit49
- [NameCheap](https://phishdestroy.io/registrar/namecheap/)41

### Top-level domains

- [.com](https://phishdestroy.io/tld/com/)604
- [.app](https://phishdestroy.io/tld/app/)232
- [.dev](https://phishdestroy.io/tld/dev/)128
- [.io](https://phishdestroy.io/tld/io/)52
- [.net](https://phishdestroy.io/tld/net/)48
- [.top](https://phishdestroy.io/tld/top/)26
- [.org](https://phishdestroy.io/tld/org/)24
- [.cn](https://phishdestroy.io/tld/cn/)23

### Hosting networks

- Cloudflare, Inc.222
- Amazon.com, Inc.126
- AMAZON-02 - Amazon.com, Inc., US96
- Google LLC94
- Microsoft Corporation75
- Wildcard UK Limited48
- WEEBLY - Weebly, Inc., US45
- WILDCARD-AS Wildcard UK Limited, GB39

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/)
- [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action)
- [All impersonated brands](https://phishdestroy.io/brand/)

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Microsoft; share of all PhishDestroy reports: 0.68%.

Canonical: https://phishdestroy.io/brand/microsoft/