# login.microsofltonline.org — MALICIOUS

> login.microsofltonline.org is a Microsoft-branded phishing domain mimicking the real login portal; 15 out of 95 VirusTotal engines flag it as malicious.

## Summary
PhishDestroy identifies login.microsofltonline.org as an active credential-phishing site masquerading as Microsoft Online. The domain’s false branding attempts to trick visitors into surrendering Microsoft account credentials or corporate login details, enabling follow-on account takeover, data theft, or lateral network movement.

This domain was flagged by 15 of 95 VirusTotal security vendors, is registered through Amazon Registrar, Inc., and first appeared on December 12, 2019. The IP address 23.22.250.230 hosts the page and is served over an Amazon-issued SSL certificate, a tactic attackers use to appear legitimate. Despite the HTTPS padlock, the mismatch between the domain name and Microsoft’s official endpoints is a clear red flag.

If you visited login.microsofltonline.org and entered any credentials, immediately change the password on all accounts using that email or username and enable multi-factor authentication. Review account sign-in logs for unauthorized access, revoke any suspicious OAuth tokens, and run a malware scan on the device you used. Report the domain to Microsoft’s phishing team and your organization’s security desk to help block future attempts.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2019-12-12 14:28:35
- Registrar: Amazon Registrar, Inc.
- IP: 23.22.250.230

## Detection Status
- VirusTotal: 15 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/domains/login.microsofltonline.org
- PhishDestroy: https://phishdestroy.io/domain/login.microsofltonline.org/
- LLM endpoint: https://phishdestroy.io/domain/login.microsofltonline.org/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/login.microsofltonline.org/
Last updated: 2026-04-10