# PhishDestroy domain threat record: onmicrosoftonline-mmscrmcustomers.mm.am

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/onmicrosoftonline-mmscrmcustomers.mm.am/
Machine-readable companion: https://phishdestroy.io/domain/onmicrosoftonline-mmscrmcustomers.mm.am/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-07 05:32:38 UTC
- Last availability or vendor check: 2026-10-22 10:06:26 UTC
- Stored record updated: 2026-10-22 15:46:10 UTC
- VirusTotal detections in the stored snapshot: 10/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Microsoft

## Stored infrastructure

- Observed IP address: 20.70.24.97
- Registrar in stored WHOIS data: abcdomain (ABCDomain LLC)
- Registration date in stored WHOIS data: 2016-05-30 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a114df-bf3e-74c7-a334-147309872a35/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/onmicrosoftonline-mmscrmcustomers.mm.am
- Certificate Transparency search: https://crt.sh/?q=%25.onmicrosoftonline-mmscrmcustomers.mm.am
- Web Archive lookup: https://web.archive.org/web/*/https://onmicrosoftonline-mmscrmcustomers.mm.am/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
This domain impersonates Microsoft. Its name strings together "onmicrosoftonline" and "crmcustomers" so that a hurried reader takes it for a Microsoft sign-in or customer portal. The likely targets are Microsoft account holders and business users who expect CRM or tenant notifications. PhishDestroy first flagged it on 2026-10-07. As of 2026-10-19 the server still responded, but DNS for the content was inactive.

How the scam works
Microsoft impersonation pages copy the familiar sign-in flow and ask for an email address and password, sometimes followed by a one-time code. Whatever is typed goes to the operators, who can then take over mailboxes, files and connected business apps. The page currently returns the title "404 Not Found", while our classification of the domain is Microsoft impersonation phishing.

Evidence
Ten of 92 VirusTotal engines flagged the domain on 2026-10-07. The flagging vendors included ESET, Kaspersky, Fortinet, Netcraft, Emsisoft, CRDF, alphaMountain.ai and MalwareURL. That is a modest share of engines, but the detections come from several unrelated vendors. urlscan.io independently returned a malicious verdict and recognised Microsoft branding on the page. The domain is listed on the PhishDestroy blocklist.

Infrastructure
The registration date is 2016-05-31, roughly a decade before we detected the domain. The long, brand-stuffed hostname under mm.am was registered through ABCDomain LLC. The site is hosted in Australia on Microsoft's own cloud network, AS8075, so the address itself looks like Microsoft infrastructure at a glance. Its valid certificate from DigiCert's GeoTrust line means the padlock appears in the browser. A padlock only shows the connection is encrypted and says nothing about who runs the site.

What to do
If you entered credentials here, change your Microsoft password immediately and update any other account that shares it. Review and reset your multi-factor methods, and sign out all active sessions. Check your mailbox for new forwarding rules and unfamiliar app consents, and alert your IT team if this was a work account. Defenders should block the domain and search mail and proxy logs for visits or messages that point to it. They should also reset credentials for any users who reached the page.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a114df-bf3e-74c7-a334-147309872a35/
VirusTotal report: https://www.virustotal.com/gui/domain/onmicrosoftonline-mmscrmcustomers.mm.am
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=onmicrosoftonline-mmscrmcustomers.mm.am
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:57:09 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a114df-bf3e-74c7-a334-147309872a35.png
  Captured: 2026-10-07 05:41:39 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a114df-bf3e-74c7-a334-147309872a35.png
  Captured: 2026-10-07 05:41:39 UTC
  Source report: https://urlscan.io/result/01a114df-bf3e-74c7-a334-147309872a35/
- URLScan capture 2: https://urlscan.io/screenshots/01a10c26-42f9-7252-8e64-5f509f792c7c.png
  Captured: 2026-10-07 05:32:38 UTC
  Source report: https://urlscan.io/result/01a114df-bf3e-74c7-a334-147309872a35/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/10dc9216-afc7-4c64-8851-8d1ecbd61368.png
  Captured: 2026-10-07 05:35:33 UTC
  Source report: https://radar.cloudflare.com/scan/10dc9216-afc7-4c64-8851-8d1ecbd61368
  SHA-256: ae945a3de4b1fa4e0b298afc22800a28d40dcb75c987229ab709961e0ec67584
- URLQuery: https://screenshots.phishdestroy.io/uq/e11eae9c-e771-4dc5-80c2-4dc0b6d0164a.png
  Source report: https://urlquery.net/report/e11eae9c-e771-4dc5-80c2-4dc0b6d0164a
  SHA-256: 08155ea088c8176a94b64aac0257a82c3093a56710e1133ac4e05637234d9501
- URLScan · 2026-10-01: https://screenshots.phishdestroy.io/us/01a0f4fc-6eca-73c8-a286-629ef415a365.png
  Captured: 2026-10-01 01:03:07 UTC
  Source report: https://urlscan.io/result/01a0f4fc-6eca-73c8-a286-629ef415a365/
  SHA-256: 9cd6631939f945df3a4b080d20e0d1e1b81d9ddc1da0f63b3132ec9cd047087b
- URLScan · 2026-10-01: https://screenshots.phishdestroy.io/us/01a0f5ba-6e72-73cb-96cd-0b3255d310d2.png
  Captured: 2026-10-01 04:30:38 UTC
  Source report: https://urlscan.io/result/01a0f5ba-6e72-73cb-96cd-0b3255d310d2/
  SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599
- URLScan · 2026-10-02: https://screenshots.phishdestroy.io/us/01a0fd2c-aaf2-755a-ae9c-a4f8d9693909.png
  Captured: 2026-10-02 15:12:47 UTC
  Source report: https://urlscan.io/result/01a0fd2c-aaf2-755a-ae9c-a4f8d9693909/
  SHA-256: 9cd6631939f945df3a4b080d20e0d1e1b81d9ddc1da0f63b3132ec9cd047087b
- URLScan · 2026-10-02: https://screenshots.phishdestroy.io/us/01a0fe0a-afcc-77c3-b8f2-99e32feb92e4.png
  Captured: 2026-10-02 19:15:15 UTC
  Source report: https://urlscan.io/result/01a0fe0a-afcc-77c3-b8f2-99e32feb92e4/
  SHA-256: 6a9584821136a74cbbcf63e6a58910aa299cfca4f04e0221b568501cfbc21047
- URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a114db-eefc-71ab-a120-3e31806b0329.png
  Captured: 2026-10-07 05:35:27 UTC
  Source report: https://urlscan.io/result/01a114db-eefc-71ab-a120-3e31806b0329/
  SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a1283a-82ef-73e4-978f-cec80972ff1d.png
  Captured: 2026-10-10 23:51:32 UTC
  Source report: https://urlscan.io/result/01a1283a-82ef-73e4-978f-cec80972ff1d/
  SHA-256: 6a9584821136a74cbbcf63e6a58910aa299cfca4f04e0221b568501cfbc21047

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T19:27:50Z",
        "uuid": "01a114df-bf3e-74c7-a334-147309872a35",
        "scanned_at": "2026-10-07T05:39:40Z",
        "final_url": "https://onmicrosoftonline-mmscrmcustomers.mm.am/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://onmicrosoftonline-mmscrmcustomers.mm.am/",
                "from": "https://onmicrosoftonline-mmscrmcustomers.mm.am/login"
            }
        ],
        "domains": [
            "aadcdn.msauth.net",
            "portal.microsoftonline.com",
            "login.microsoftonline.com",
            "browser.events.data.microsoft.com",
            "login.live.com"
        ],
        "ips": [
            "13.107.246.40",
            "150.171.73.13",
            "20.190.151.132",
            "20.70.24.97"
        ],
        "asns": [
            "8075"
        ],
        "countries": [
            "US",
            "AU"
        ],
        "doc_hash": "592f97e695144575c63e4ac90d0c7c0880bafb67132a0eec9dcd8f21198cfb0f",
        "script_hashes": [
            "30babf1b4d9143e94fcb3e8b9b886f103fe4ce3959e951cc2535fd2ff5b84f64"
        ],
        "globals": [
            "updateHTMLAttribute",
            "$Config",
            "$Debug",
            "$Do",
            "$Loader",
            "$WebWatson",
            "GetString",
            "GetErrorString",
            "GetUrl",
            "$B",
            "AddListener",
            "ClickEventListenerById",
            "ClickEventListenerByName",
            "ServerData",
            "webpackJsonp",
            "ko",
            "PROOF",
            "StringRepository",
            "Telemetry",
            "telemetry_webpackJsonp",
            "__ConvergedLogin_PCore",
            "__",
            "__convergedlogin_pcustomizationloader_9c8e0cdaf73ea3a51251",
            "observer",
            "attributes"
        ],
        "cookies": [
            "XxmiU8sDwNCt",
            "x-ms-gateway-slice",
            "brcap",
            "s.SessID"
        ],
        "storage_keys": [
            "Tue Oct 06 2026 19:39:38 GMT-1000 (Hawaii-Aleutian Standard Time)"
        ],
        "tls": {
            "san": [
                "onmicrosoftonline-mmscrmcustomers.mm.am"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "GeoTrust TLS RSA CA G1",
            "subject": "onmicrosoftonline-mmscrmcustomers.mm.am",
            "protocol": "TLS 1.3",
            "valid_to": "2027-03-25T23:59:59Z",
            "valid_from": "2026-09-25T00:00:00Z"
        },
        "domain_age_days": 11,
        "apex_age_days": 3479,
        "tls_age_days": 12,
        "tls_valid_days": 181,
        "requests": 27,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 74,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "microsoft"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Microsoft"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T19:37:38Z",
        "uuid": "10dc9216-afc7-4c64-8851-8d1ecbd61368",
        "scanned_at": "2026-10-07T05:35:33Z",
        "final_url": "https://onmicrosoftonline-mmscrmcustomers.mm.am/",
        "status": 404,
        "history": [
            {
                "url": "https://onmicrosoftonline-mmscrmcustomers.mm.am/",
                "status": 404
            }
        ],
        "dom_hash": "42065dba3b8a7b2130dd66fe299c26c1aa681d7c7f2893f8410bbcd2d2e1770d",
        "doc_hash": "66e3a7e7cea0e0786aaebc8712bdb23b72c2c1bd94084f8f749e4140a17b836c",
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "onmicrosoftonline-mmscrmcustomers.mm.am",
                "type": "A",
                "value": "20.70.24.97"
            }
        ],
        "dnssec_valid": false,
        "ip": "20.70.24.97",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "abcdomain (ABCDomain LLC)",
            "created": "2016-05-31T00:00:00Z",
            "updated": "2026-07-03T00:00:00Z",
            "expires": "2027-05-31T00:00:00Z"
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T10:26:22Z",
        "analysis_at": "2026-10-13T00:31:35Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 3,
            "suspicious": 0,
            "undetected": 37
        },
        "detections": {
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious"
        },
        "reputation": 0,
        "registrar": "abcdomain (ABCDomain LLC)",
        "expires": "2027-05-31T00:00:00Z",
        "first_seen": "2026-09-25T13:56:05Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "root.sh00135.cd.ds.network",
                "value": "ns1.syrahost.com"
            },
            {
                "ttl": 3599,
                "type": "MX",
                "value": "onmicrosoftonlinemmscrmcustomers-mm-am04c.mail.protection.outlook.com",
                "priority": 0
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 a mx include:websitewelcome.com ~all"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "20.70.24.97"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 include:spf.protection.outlook.com -all"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "MS=ms77726575"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.syrahost.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.syrahost.com"
            }
        ],
        "dns_at": "2026-10-08T10:48:45Z",
        "jarm": "2ad2ad00000000000042d42d00042da9006a0dbf6f6785a41d588d6e6fd492",
        "cert": {
            "san": [
                "onmicrosoftonline-mmscrmcustomers.mm.am"
            ],
            "issuer": "DigiCert Inc / GeoTrust TLS RSA CA G1",
            "serial": "61187512fa9019c285d6faac5b7652f",
            "sha256": "f2546fa53078bdddf33dd2eaca780f976f301175120178bf774042eb9f2631d1",
            "subject": "onmicrosoftonline-mmscrmcustomers.mm.am",
            "valid_to": "2027-03-25T23:59:59Z",
            "valid_from": "2026-09-25T00:00:00Z"
        },
        "whois": {
            "registrar": "abcdomain (ABCDomain LLC)"
        }
    }
}
```