howtoauthorizemicrosoftinfo[.]com

The domain howtoauthorizemicrosoftinfo.com was registered on May 27, 2026 through GoDaddy.com, LLC. Its sole purpose appears to be brand impersonation of Microsoft, as indicated by the domain name and the identical page title returned by the web server. The site is currently active, responding with HTTP status code 200, and is listed on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. Technical infrastructure analysis shows the domain resolves to the IPv4 address 13.248.243.5, which is associated with an Amazon Web Services Global Accelerator node located in Canada. The TLS certificate presented by the server is issued by Starfield Technologies, Inc. under the Starfield Secure Certificate Authority – G2, a widely used commercial CA. The Gridinsoft trust rating for the host is 0 out of 100, reflecting a lack of trust signals. VirusTotal scanning reports that a single security vendor out of ninety‑five has flagged the domain, while the remaining scanners returned a clean result. This low detection count does not mitigate the high risk rating assigned to the campaign, given the explicit Microsoft brand abuse and the active hosting of malicious content. The domain’s presence on multiple blocklists confirms that defensive feeds are already aware of the threat. Defenders should prioritize immediate blocking of the domain and its resolved IP address at perimeter and DNS layers. Network monitoring should include alerts for outbound connections to 13.248.243.5 and any TLS handshake using the Starfield Secure Certificate Authority – G2 chain that references the domain name. Incident response teams should also hunt for credential‑phishing artifacts that reference the “howtoauthorizemicrosoftinfo.com” URL in email logs and user reports.