micronsofftt[.]com

Analysis of micronsofftt.com indicates a high-risk credential phishing domain impersonating Microsoft. The domain was registered on April 24, 2026, through Wild West Domains, LLC, and is currently active with an HTTP 200 status. Infrastructure analysis reveals the domain resolves to IP address 125.5.193.25, hosted by Philippine Long Distance Telephone Co., a location and provider frequently associated with malicious activity. The domain uses nameservers ns21.domaincontrol.com and ns22.domaincontrol.com, a common configuration for domains involved in phishing operations. It is flagged on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and appears in one AlienVault OTX threat intelligence pulse, confirming its malicious classification. The domain's SSL certificate is issued by Let's Encrypt, a legitimate but frequently abused certificate authority in phishing campaigns. The page title 'Error Page' suggests the site may be in a transitional state or deliberately obfuscating its true content, though the exact nature of the phishing kit or payload is not yet confirmed. One of 94 security vendors on VirusTotal has flagged the domain, providing additional evidence of its malicious intent. Defenders should treat this domain as actively hostile and prioritize blocking or monitoring any traffic associated with it. Given the domain's recent registration and confirmed presence on multiple blocklists, organizations are advised to update their threat intelligence feeds and conduct internal reviews for any exposure to this infrastructure.