rootinge[.]ukwest[.]cloudapp[.]azure[.]com

This domain, rootinge.ukwest.cloudapp.azure.com, has been identified as a high-risk credential phishing endpoint targeting users through a fraudulent security portal interface. The page, titled Centre de sécurité, mimics legitimate authentication pages to harvest login credentials, likely for financial or corporate accounts. Analysis indicates the domain is designed to exploit trust in cloud-hosted services, leveraging Microsoft Azure infrastructure to appear legitimate while executing phishing operations. Infrastructure analysis reveals the domain was registered on October 25, 1994, through MarkMonitor, Inc., a registrar commonly associated with both legitimate and malicious domains. Detection metrics show 16 out of 95 security vendors on VirusTotal flag the domain as malicious, with Google Safe Browsing explicitly classifying it as phishing. The domain resolves to the IP address 51.11.110.216, hosted within the Microsoft Azure Cloud (ukwest) region in Great Britain. It appears on one security blocklist and is actively blocked by at least one anti-phishing system. Users who visited rootinge.ukwest.cloudapp.azure.com should immediately revoke any entered credentials, particularly if they correspond to sensitive accounts such as banking, email, or corporate systems. It is recommended to scan the device for malware, as phishing pages may deploy additional payloads. Monitor accounts for unauthorized activity and enable multi-factor authentication where available. Network administrators should update blocklists to include this domain and its associated IP address to prevent further access within their environments.