login[.]microsoftonline[.]hmvegn[.]ie

Analysis of login.microsoftonline.hmvegn.ie indicates an active high‑risk brand impersonation campaign targeting Microsoft credentials. The domain was registered on June 10, 2026 through GoDaddy.com, LLC and resolves to IP address 20.82.96.115, which is geolocated to the Netherlands and belongs to ASN 8075 (Microsoft Corporation). The hosting environment reports Ubuntu with Apache HTTP Server, and the site presents a valid SSL certificate issued by Let’s Encrypt (YE1). The page title returned by the server is "Sign in to your Microsoft account," matching the declared brand target. Security intelligence shows the domain appears on two blocklists and is flagged by Google Safe Browsing for social engineering. VirusTotal scans recorded detections by 25 of 91 security vendors. The site is currently blocked by PhishDestroy and Phishunt, and its Gridinsoft trust score is 0/100. Nameservers are set to amit.ns.cloudflare.com and liv.ns.cloudflare.com, indicating use of a CDN. While the visible content has not been manually inspected, the combination of brand‑specific page title, high detection count, and presence on multiple blocklists confirms a credential‑phishing intent. Defenders should update URL filtering rules to block the domain, enforce multi‑factor authentication for Microsoft accounts, and monitor network traffic for connections to 20.82.96.115. Incident response teams should also consider adding the domain to internal threat intelligence feeds and alerting users about unsolicited login prompts referencing Microsoft services.