auth-secure[.]pt

This domain, auth-secure.pt, is identified as a high-risk credential phishing site targeting Microsoft users. The site impersonates Microsoft login portals, presenting a page titled 'Sign in to your account' to harvest user credentials. No specific phishing kit signatures were detected in initial analysis, but the domain follows common brand impersonation tactics observed in credential theft campaigns. The infrastructure and content are designed to deceive users into entering sensitive authentication details, which are likely exfiltrated to attacker-controlled servers for subsequent unauthorized access or account takeover. Analysis indicates the domain was registered on September 11, 2025, and resolves to the IP address 81.88.53.145, hosted on AS39729 (REGISTER S.P.A.) in Italy. The domain is flagged by Google Safe Browsing as phishing and appears on two security blocklists. VirusTotal reports 18 out of 95 security vendors detecting this domain as malicious. The SSL certificate is issued by Let's Encrypt (serial number E7), which, while providing encryption, does not validate the legitimacy of the site. The rapid detection by multiple security vendors and blocklists underscores the domain's malicious intent and the urgency of its takedown. As of the latest verification, auth-secure.pt has been taken offline, reducing immediate exposure to users. However, the infrastructure remains a residual risk, as attackers may repurpose the IP or registrar for future phishing campaigns. Organizations and individuals are advised to block the domain and associated IP at the network level. Users who may have interacted with the site should reset credentials for any accounts entered, enable multi-factor authentication, and monitor for unauthorized activity. Continuous monitoring of related domains and IPs is recommended to preempt potential follow-up attacks.