rnicrosoft-auth[.]com

The domain rnicrosoft-auth.com is identified as a generic phishing infrastructure designed to impersonate Microsoft authentication services. The observed behavior indicates credential harvesting attempts through fake login pages intended to capture user credentials and session data. The site is currently offline, but historical indicators confirm malicious intent and prior deployment of phishing content.

Analysis shows the domain was flagged by 21 of 95 VirusTotal security vendors, indicating strong cross-engine detection consensus. It was created on November 24, 2025 and registered through Wild West Domains, LLC. The infrastructure resolves to IP address 116.203.147.75 and is hosted in Germany under AS24940 Hetzner Online GmbH. Additional intelligence includes Google Safe Browsing classification as phishing, appearance on 2 security blocklists, SSL certificate issued via Let's Encrypt R13, and active blocking by PhishDestroy and PhishingDB. The page title observed during analysis was “ThriveDX — Page not found,” suggesting either decoy content or a removed phishing landing page.

Although the domain is currently taken offline, the combination of high detection coverage (21/95), recent registration date (November 24, 2025), and use of reputable hosting infrastructure indicates a professionally operated phishing setup with potential for rapid redeployment. Users who may have interacted with this domain should assume credential compromise risk, particularly for Microsoft accounts, and should immediately reset passwords and enable multi-factor authentication. Security teams are advised to block IP 116.203.147.75, monitor Wild West Domains registrations for similar spoofed naming patterns, and track TLS certificate reuse under Let's Encrypt R13. Continued vigilance is required due to the likelihood of cloned infrastructure reactivation.