hr[.]goolge-secure[.]com

Analysis of the domain hr.goolge-secure.com confirms its classification as an active credential phishing site targeting Microsoft users. The domain was registered on April 30, 2025, through TUCOWS.COM, CO., and currently resolves to IP address 52.30.103.131, hosted on Amazon.com, Inc. infrastructure (AS16509) located in Ireland. The page title, 'Sign in to your Microsoft Account,' explicitly indicates an attempt to impersonate Microsoft login portals, aligning with the credential phishing classification. Infrastructure review reveals the use of AWS nameservers (ns-1164.awsdns-17.org, ns-151.awsdns-18.com, ns-1875.awsdns-42.co.uk, ns-605.awsdns) and an SSL certificate issued by Sectigo Limited (Sectigo Public Server Authentication CA DV R36). The domain is flagged by 9 of 91 security vendors in available scans and appears on at least one security blocklist. A Gridinsoft trust score of 0/100 further supports its malicious designation. The site remains operational as of July 12, 2026, returning an HTTP 200 status, confirming active hosting. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where Microsoft services are used. The use of HSTS suggests the site may attempt to appear legitimate to security tools, though this does not mitigate its confirmed phishing intent. No evidence currently links this domain to a specific phishing kit or broader campaign, and the exact content beyond the page title remains unanalyzed. Organizations should monitor for credential submission attempts originating from this domain and consider revoking any credentials potentially exposed through it.