microsoft-login[.]it

This domain, microsoft-login.it, is identified as a brand impersonation threat targeting Microsoft account credentials. Analysis indicates the domain hosts a fraudulent login page titled 'Sign in to your Microsoft account,' designed to harvest user credentials through deceptive authentication prompts. No evidence of a drainer kit or secondary payload delivery was observed, but the page structure closely mimics legitimate Microsoft login portals, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Sensible Data s.p.a., and resolves to the IP address 116.202.107.52, hosted on AS24940 (Hetzner Online GmbH) in Germany. The domain is flagged by 24 out of 95 security vendors on VirusTotal, with detection labels primarily categorizing it as a phishing site. It appears on one security blocklist, and its SSL certificate is associated with an unrelated domain, test-gozzo.dev, suggesting potential misuse of shared or compromised infrastructure. As of the latest assessment, microsoft-login.it has been taken offline, reducing immediate exposure risk. However, the domain remains registered, and the infrastructure may be repurposed for future campaigns. Organizations are advised to monitor for related indicators, including the IP address and registrar details, and implement domain-based blocking for microsoft-login.it in security controls. Users should verify login portals via official channels and enable multi-factor authentication to mitigate credential theft risks.