login[.]authsharedepointsonline[.]top

login.authsharedepointsonline.top is a high-risk credential phishing domain actively impersonating Microsoft SharePoint Online login pages to harvest user credentials. This domain represents a direct threat to organizations using Microsoft 365 services, as it attempts to trick users into submitting their login details on a fraudulent interface.

This domain was flagged by 16 out of 95 security vendors on VirusTotal, indicating widespread detection of its malicious nature. The domain was registered through NameSilo,LLC on April 08, 2026, and resolves to the IP address 75.119.137.73. It carries a Let’s Encrypt SSL certificate and is blocked by Google Safe Browsing under the SOCIAL_ENGINEERING category, confirming its use in deceptive impersonation tactics.

Users should avoid accessing this domain entirely and report it immediately if encountered in any context. Organizations should implement browser-based blocklisting for this domain and related indicators, reinforce user awareness training focused on recognizing SharePoint Online login anomalies, and validate any suspicious login prompts through official Microsoft authentication channels. Immediate credential rotation is advised for any accounts potentially exposed to this phishing attempt.