login[.]microsofltonline[.]org

PhishDestroy identifies login.microsofltonline.org as an active credential-phishing site masquerading as Microsoft Online. The domain’s false branding attempts to trick visitors into surrendering Microsoft account credentials or corporate login details, enabling follow-on account takeover, data theft, or lateral network movement.

This domain was flagged by 15 of 95 VirusTotal security vendors, is registered through Amazon Registrar, Inc., and first appeared on December 12, 2019. The IP address 23.22.250.230 hosts the page and is served over an Amazon-issued SSL certificate, a tactic attackers use to appear legitimate. Despite the HTTPS padlock, the mismatch between the domain name and Microsoft’s official endpoints is a clear red flag.

If you visited login.microsofltonline.org and entered any credentials, immediately change the password on all accounts using that email or username and enable multi-factor authentication. Review account sign-in logs for unauthorized access, revoke any suspicious OAuth tokens, and run a malware scan on the device you used. Report the domain to Microsoft’s phishing team and your organization’s security desk to help block future attempts.