login-microsoftonline.pl

PhishDestroy first observed login-microsoftonline.pl on Sep 16, 2026. The hostname explicitly references Microsoft and uses “login,” a pattern consistent with a account-login lure; stored content metadata identifies the same apparent target. Current evidence score: 95/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, Cloudflare Radar, and URLQuery. VirusTotal recorded 16 detections among 89 engines: alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Seclookup, SOCRadar, Sophos, VIPRE, Webroot on Sep 16, 2026 at 20:16 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the malware category; its verdict timestamp was not retained. URLQuery recorded 5 threat-system alerts on Sep 16, 2026 at 19:27 UTC. Non-positive and contextual checks: AlienVault OTX listed 5 community pulse references (not vendor detections) on Sep 16, 2026 at 20:17 UTC. The separate external-blocklist snapshot contained no matches on Sep 16, 2026 at 18:20 UTC. Google Safe Browsing returned no flag on Sep 16, 2026 at 20:16 UTC. URLScan captured the page on Sep 16, 2026 at 19:15 UTC.

The collector marked the hostname reachable on Sep 16, 2026 at 19:15 UTC, but did not retain the HTTP response code. Registration records for the domain list nazwa.pl sp. z o.o. as the registrar and Mar 30, 2026 as the creation date. At collection time, the hostname resolved to 85.128.128.104. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery; no page title was retained, so the captures preserve the landing-page appearance.

The content indicators and 3 positive source findings support the current Microsoft-themed account-login phishing classification. The target field identifies Microsoft, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.