id[.]milestonelogin[.]com

This domain, id.milestonelogin.com, is actively impersonating Microsoft as part of a high-risk phishing infrastructure. Registered on February 21, 2026, through CSC Corporate Domains, Inc., the domain resolves to the IP address 13.107.246.45, which is hosted on Microsoft Corporation's network (AS8075) in the United States. The domain's nameservers are Azure DNS services, a configuration consistent with legitimate Microsoft properties, though in this case, they are being exploited to lend credibility to the phishing operation. The SSL certificate is issued by DigiCert Inc under the GeoTrust TLS RSA CA G1 intermediate, a common certificate authority that does not inherently indicate malicious activity but is frequently used in phishing campaigns to avoid browser warnings.

The page title, 'Sign in to your account,' aligns with typical Microsoft login portal impersonation, though the exact content and functionality of the site remain unconfirmed. The domain currently returns an HTTP 302 redirect status, suggesting it may be part of a multi-stage phishing chain or is actively funneling victims to another malicious endpoint. As of July 22, 2026, the domain is flagged by one security blocklist and is blocked by PhishDestroy. VirusTotal reports that 2 out of 93 security vendors have detected this domain as malicious, indicating early but growing recognition of its threat status.

Defenders should prioritize blocking this domain at the DNS and network layers, particularly in environments where Microsoft credentials are used. The use of Azure DNS and a Microsoft-hosted IP may complicate detection, as these are legitimate services; however, the combination of the domain's registration details, page title, and detection by security vendors provides sufficient evidence for mitigation. Additional monitoring of related domains registered through CSC Corporate Domains or resolving to the same IP range is recommended, as this infrastructure may be reused for future campaigns.