microxoft-com[.]live

PhishDestroy analysts have flagged microxoft-com.live, an active abuse domain impersonating Microsoft to harvest user credentials via a fraudulent login interface. Domain indicators align with generic phishing toolkits commonly used to target Microsoft account holders, with the goal of credential theft and potential account takeover. No crypto drainer payload is detected, but user input is directly exfiltrated to attacker-controlled endpoints. This domain resolves to IP 34.42.100.71 and leverages a Let’s Encrypt SSL certificate to appear legitimate. Registered through Unstoppable Domains Inc on May 5 2026, the domain currently shows zero detections (0/95) across VirusTotal sandboxes and is unverified by Google Safe Browsing (GSB status: unknown). Analysis indicates no confirmed blacklist entries to date, suggesting early-stage deployment. As of today, the domain remains active and unblocked across most networks. PhishDestroy’s systems continue to monitor the threat and have initiated automated takedown requests with hosting and registrar partners. While the immediate technical risk is low due to absence of known malware payloads, the potential for credential theft remains significant until the domain is fully neutralized. Users are strongly advised to avoid interacting with microxoft-com.live and to verify any Microsoft-themed login links using PhishDestroy’s real-time verification tool.