graph[.]login[.]userverifylogin[.]com

This domain, graph.login.userverifylogin.com, poses a significant credential theft threat by impersonating Microsoft’s login infrastructure. Analysis indicates the site was designed to harvest user account credentials under the guise of a legitimate Microsoft sign-in page, as evidenced by its page title, 'Sign in to your Microsoft account.' Such impersonation attacks are commonly used to gain unauthorized access to corporate or personal data, deploy malware, or facilitate further fraudulent activities. Infrastructure analysis reveals multiple high-confidence indicators of malicious intent. The domain was registered on December 9, 2025, through GoDaddy.com, LLC, and currently resolves to the IP address 44.222.203.160, hosted on Amazon Web Services (AS14618). It lacks an SSL certificate, a critical security red flag for any login portal. Security vendors have flagged the domain as malicious, with 23 out of 95 engines on VirusTotal detecting it as phishing. Additionally, Google Safe Browsing has classified it as a phishing site, and it appears on at least one security blocklist. If you or someone in your organization visited graph.login.userverifylogin.com and entered credentials, immediate action is required. Disconnect the affected device from the network to prevent potential lateral movement or data exfiltration. Reset all passwords associated with the compromised account, particularly for Microsoft services, using a separate, secure device. Enable multi-factor authentication (MFA) if not already active. Monitor the account for unauthorized access or suspicious activity, and review connected applications for signs of compromise. If corporate credentials were exposed, report the incident to your security team for further investigation and containment.