microsoft[.]authorised-support[.]com

The domain microsoft.authorised-support.com is identified as a high-risk brand impersonation phishing site designed to mimic Microsoft's authentication portal. Analysis confirms the site was actively spoofing the "Sign in to your Microsoft account" page, targeting users with fraudulent credential harvesting. The domain is currently offline but was operational during its detection window. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on March 25, 2026, an anomalous creation date suggesting potential backdating or registry manipulation. It resolved to IP address 3.174.46.41, hosted on AWS CloudFront infrastructure in Germany, and presented an SSL certificate issued by Amazon RSA 2048 M02. Security vendors flagged the domain on 18 of 95 VirusTotal engines, while four independent blocklists—PhishDestroy, OpenPhish, Phishunt, and PhishingDB—listed it as malicious. Google Safe Browsing also classified the site as phishing. Although the domain is now offline, its prior activity and infrastructure indicators remain relevant for detection and prevention. Organizations should update web filters to block microsoft.authorised-support.com and monitor for residual DNS queries or cached redirects. Users who may have interacted with the site should reset credentials through legitimate Microsoft channels and enable multi-factor authentication. Security teams are advised to review logs for connections to 3.174.46.41 or related CloudFront endpoints during the exposure period.