login-hotmaii[.]com

The domain login-hotmaii.com has been identified as a brand impersonation threat specifically targeting Microsoft account authentication portals. Analysis confirms the domain was actively spoofing the Microsoft sign-in interface, as evidenced by its page title 'Sign in,' which aligns with credential harvesting tactics. The domain is currently offline, though prior activity suggests it was operational for malicious purposes. Technical indicators reveal the domain was flagged by 25 of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence platforms. Infrastructure analysis shows the domain was registered through Hosting Concepts B.V. d/b/a Registrar.eu on March 23, 2026, and resolved to the IP address 45.74.47.162, geolocated in Germany. The domain appears on at least one security blocklist, and its SSL certificate was issued by Let's Encrypt (R13). The creation date, combined with the rapid detection by security vendors, suggests a short-lived but high-impact campaign. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to monitor for unauthorized access attempts linked to Microsoft credentials, particularly if login attempts were made during the domain's active period. Network administrators should block the IP address 45.74.47.162 and the domain login-hotmaii.com at the perimeter to prevent residual exposure. Users are recommended to enable multi-factor authentication on all accounts and review recent login activity for anomalies.