verify-auth30-cookies[.]info

The domain verify-auth30-cookies.info is identified as a high-risk brand impersonation threat specifically targeting Microsoft. Analysis confirms the domain was designed to mimic legitimate Microsoft security verification pages, as evidenced by its page title, 'Microsoft Security - Verify Your Identity.' The domain is currently offline, but prior activity suggests it was operational for credential harvesting or account compromise purposes. Infrastructure analysis reveals the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on May 8, 2026, an unusually future-dated registration likely intended to evade immediate detection. It resolves to the IP address 188.114.97.3 and was flagged by 16 of 95 security vendors on VirusTotal. The domain appears on three security blocklists and holds a Gridinsoft trust score of 0/100, reinforcing its malicious classification. Technologies detected include HSTS, Cloudflare, and HTTP/3, which may have been leveraged to enhance perceived legitimacy or obfuscate traffic analysis. Blocking actions were implemented by MetaMask, PhishDestroy, and SEAL, further validating its association with fraudulent activity. Current status indicates the domain has been taken offline, though residual risk persists due to potential reuse of infrastructure or redirection to alternate malicious endpoints. Organizations are advised to proactively block the domain and its associated IP address at the network perimeter. Security teams should monitor for related indicators, including future registrations under the same registrar or IP range. End-users should be educated on recognizing brand impersonation tactics, particularly those involving security verification prompts. If credentials were entered on this domain, immediate password resets and multi-factor authentication enforcement are strongly recommended to mitigate account compromise risks.