wildlands.acltci.com is a phishing page that impersonates Microsoft to capture the login details of people who use Microsoft accounts for email, files and work. PhishDestroy first flagged it on 2026-09-25. As of 2026-10-19 the host was still online and redirecting visitors, so the lure remains active.
How the scam works
Microsoft impersonation pages copy the familiar sign-in flow, usually reached through a link in an email about a shared document, a voicemail or an account warning. Anything typed into the fake form, including your email address, password and often a one-time 2FA code, goes straight to the operators. They can then read mail, reset other passwords and send new phishing from your account to your contacts. The page title currently reads "404 Not Found", which conflicts with our classification of the site as a Microsoft impersonation page.
Evidence
On 2026-10-09, 16 of 92 VirusTotal engines flagged the site, among them BitDefender, Fortinet, Forcepoint ThreatSeeker, Emsisoft, G-Data, CRDF, DNS8 and Lionic. A large majority of engines still treat it as clean, so many filters will not block it on their own. urlscan.io independently rated the page malicious and recognised Microsoft branding in its content. PhishDestroy lists it on our blocklist.
Infrastructure
The parent domain acltci.com was registered on 2010-09-28 through TUCOWS.COM, CO., long before this phishing subdomain appeared. That makes the domain's age a poor signal of trust here, because the fraudulent content sits on one subdomain rather than on a freshly bought name. The page runs on the Render cloud platform in the US at 216.24.57.16. Hosting of this kind lets an operator deploy and replace a phishing page within minutes.
What to do
If you entered your Microsoft credentials here, change that password right away from the official Microsoft site, plus any other account that reused it. Then sign out of all sessions and review your security info and 2FA methods for anything you did not add. Check your mailbox for new forwarding or deletion rules, and warn contacts if suspicious messages went out from your address. If you only visited and typed nothing, clear the tab and report the email that brought you there. Defenders should block the full hostname at mail and web gateways, search sign-in logs for logins following clicks to it, and force credential resets for affected users.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Latest HTTP observationRedirectingHTTP redirect observed80%2026-10-20 10:06:43 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-20 10:06:43 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
使用技術 · 3 identified
R
Render
PaaS
Render is a cloud computing platform that provides a wide range of services, including web hosting, cloud computing, and application development. Render offers several hosting options, including static site hosting, web application hosting, and managed databases.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(CA)
