onlinelogin-link[.]com

This domain, onlinelogin-link.com, poses a direct threat by impersonating Microsoft's official login page. The site is designed to trick users into entering their Microsoft account credentials, which attackers then capture for unauthorized access to email, cloud storage, and other linked services. The domain's title, 'Sign in - Microsoft account,' closely mimics legitimate Microsoft authentication interfaces, increasing the likelihood of user deception.

Analysis confirms the domain is flagged as malicious by 15 out of 95 security vendors on VirusTotal, indicating broad consensus on its threat nature. It was created on June 24, 2024, through Amazon Registrar, Inc., and resolves to IP address 35.180.24.69. The infrastructure uses Nginx with OpenResty, and the SSL certificate is issued by Let's Encrypt, a common choice for low-cost phishing operations. AlienVault OTX includes the domain in one threat intelligence pulse, further corroborating its malicious profile.

If a user has visited this domain or entered credentials, immediate action is required. Change the Microsoft account password and enable two-factor authentication. Scan devices for malware or keyloggers that may have been installed. Monitor account activity for unauthorized access, and report the incident to Microsoft's security team. Avoid revisiting the site and ensure browser security settings are updated to block known threats.