ms365-live[.]com

ms365-live.com was registered on 14 May 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. Since its appearance, the domain has been classified as a generic phishing site and is currently listed as active with an elevated risk rating. Threat intelligence sources show that the domain is present on the PhishDestroy blocklist, indicating that at least one reputable anti‑phishing feed has already taken action to block it. A VirusTotal scan returned 23 positive detections out of 91 scanners, confirming that a substantial minority of security engines recognize malicious behavior associated with the domain.

No additional public data on hosting IP addresses, SSL certificate details, HTTP response codes, Safe Browsing status, or page title have been disclosed, leaving the underlying infrastructure largely opaque. The lack of further evidence does not diminish the observed risk; rather, it underscores the need for defensive operators to treat any traffic to ms365-live.com as potentially hostile. Recommended mitigations include adding the domain to deny‑list or URL filtering policies across perimeter and endpoint controls, monitoring DNS queries for look‑ups, and ensuring that email security gateways enforce strict sender authentication to reduce the chance of credential‑harvesting attempts.

Organizations should also capture TLS handshake metadata and HTTP request logs for any connections to the domain to aid future forensics. Correlation with existing phishing campaigns targeting enterprise email accounts may reveal whether the domain is being used to harvest credentials for Microsoft 365 services, given the resemblance of the name to legitimate Microsoft branding. Until further forensic evidence is released, the prudent posture is to block the domain at the network perimeter and educate users about unsolicited login requests that reference Microsoft 365.