mssecuregateway[.]de

This domain, mssecuregateway.de, operates as a credential harvesting site specifically designed to impersonate Microsoft authentication portals. Analysis indicates the page title 'Sign in to your Microsoft account' was used to deceive users into submitting login credentials, which would be captured by threat actors for unauthorized access to accounts or further malicious activities. The infrastructure mimics legitimate Microsoft services, increasing the likelihood of successful phishing attempts against unsuspecting users. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on February 21, 2026, with an SSL certificate issued by Let's Encrypt (R12), resolving to IP address 87.230.86.70 under AS8972 (Host Europe GmbH). Security vendors flagged this domain as malicious, with 25 out of 95 engines on VirusTotal detecting it as a phishing threat. Additionally, the domain appears on one security blocklist, and Google Safe Browsing has explicitly flagged it as a phishing site. The combination of these indicators confirms the domain's malicious intent. Users who visited mssecuregateway.de or entered credentials on this site should immediately take corrective action. First, reset passwords for any accounts accessed through the domain, prioritizing Microsoft and other sensitive services. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unrecognized logins or unauthorized transactions. If corporate credentials were exposed, notify internal security teams to assess potential lateral movement risks. Finally, ensure endpoint security tools are updated to detect and block similar threats in the future.