ms-online[.]live

Analysis of the domain ms-online.live, observed on August 04, 2026, indicates an active generic phishing campaign that is currently under investigation. The site has been indexed by VirusTotal and examined by 91 security vendors; at the time of analysis no vendor flagged the domain as malicious. This lack of detections is not interpreted as evidence of benign intent, but rather reflects the possibility that existing detection signatures have not yet been updated to recognize the payload or infrastructure employed.

Independent threat‑intelligence feeds have recorded the domain on a single security blocklist and it is explicitly blocked by the PhishDestroy service, confirming that external mitigation platforms consider it hostile. The limited public metadata—absence of disclosed registrar, hosting IP, SSL certificate details, or page title—precludes a deeper infrastructure profile. Consequently, the primary observable indicators are the blocklist inclusion and the VirusTotal scan result.

Defenders should treat ms-online.live as a confirmed phishing vector, enforce network‑level blocks, add the domain to local deny lists, and monitor for any associated command‑and‑control or credential‑harvesting activity. Continuous re‑evaluation is advised, as future scans may reveal detections once signature updates propagate.