mata-mski-login-helped[.]pages[.]dev

The domain mata-mski-login-helped.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Microsoft users. It presents itself as a legitimate Microsoft login portal to deceive victims into entering credentials, posing a high risk of account compromise. As of the latest verification, mata-mski-login-helped.pages.dev has been taken offline, though it remains flagged for malicious activity.

Technical analysis reveals mata-mski-login-helped.pages.dev was registered through Cloudflare, Inc. on October 17, 2025, and resolves to the IPv6 address 2606:4700:310c::ac42:2fa4, hosted on Cloudflare's infrastructure in the US. Security vendors flagged the domain with 15 of 95 detections on VirusTotal, including alerts from ADMINUSLabs, ChainPatrol, and alphaMountain.ai. Google Safe Browsing classified it under 'SOCIAL_ENGINEERING,' and it appears on one security blocklist (PhishDestroy). The SSL certificate is issued by Google Trust Services (WE1), and the site returned an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare.' Technologies detected include HSTS, Cloudflare, and HTTP/3, while Gridinsoft assigned a trust score of 0/100.

Victims who interacted with mata-mski-login-helped.pages.dev should immediately change their Microsoft account passwords and enable multi-factor authentication (MFA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions, and report the incident to Microsoft's official security team. Additionally, the domain can be reported to Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader takedown efforts.