microsoft365auth[.]live

This domain, microsoft365auth.live, is flagged as a brand impersonation threat targeting Microsoft’s authentication infrastructure. Analysis indicates it was designed to mimic Microsoft 365 login portals, likely to harvest user credentials through fraudulent input forms. No evidence of a drainer kit was observed, but the domain’s structure and naming convention align with credential phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered through GoDaddy.com, LLC on April 08, 2026, and resolves to IP address 76.223.105.230. VirusTotal detections show 8/95 security vendors flagging the domain as malicious, while Gridinsoft’s trust score rates it at 0/100. The domain appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. The SSL certificate is issued by Starfield Technologies, Inc., a common provider for both legitimate and malicious domains. As of the latest assessment, microsoft365auth.live has been taken offline, reducing immediate exposure risk. However, the domain’s infrastructure remains registered and could be reactivated. Organizations should monitor for related indicators, including the resolved IP and registrar details, and ensure endpoint protection systems block access to this domain and its associated infrastructure. Users who may have interacted with the site should reset credentials and enable multi-factor authentication on affected accounts.