account[.]msauth[.]live

This domain, account.msauth.live, is flagged as an active credential phishing site targeting Microsoft authentication credentials. Infrastructure analysis reveals it resolves to the IP address 94.154.172.98, though no nameserver records were identified at the time of assessment, which may indicate recent or incomplete DNS configuration. As of July 17, 2026, the domain remains operational, with two of 91 security vendors on VirusTotal detecting it as malicious. The limited detection count does not indicate safety, as phishing domains often evade initial scans through rapid rotation or obfuscation techniques. The domain structure, incorporating 'msauth,' strongly suggests an intent to deceive users into believing they are interacting with a legitimate Microsoft authentication service. However, the exact content and functionality of the site have not yet been analyzed, so the specific phishing kit or redirection behavior remains unconfirmed. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access to it, particularly in environments where Microsoft services are used. Network-level protections, such as DNS filtering or IP-based blocking of 94.154.172.98, are recommended to mitigate exposure. Further investigation into associated infrastructure, including hosting providers and registration details, may reveal additional linked threats.