loginmicrosoft[.]com

This domain, loginmicrosoft.com, is a newly registered brand‑impersonation site created on 24 April 2026. It mimics the Microsoft login portal and is currently listed as active with a high risk rating. The site returns HTTP 200 and presents a page title identical to the domain name, reinforcing the deceptive appearance. Technical analysis shows the domain resolves to IP address 103.224.182.251, which is geolocated in the United States and attributed to Trellian Pty. Limited. The host runs Nginx behind a Let’s Encrypt R12 certificate, and the DNS configuration uses the authoritative nameservers ns1.above.com and ns2.above.com. The Gridinsoft trust score for the site is 0 out of 100, indicating a complete lack of trust. Reputation services have begun flagging the domain. VirusTotal records a single positive detection out of 95 scanned engines. The domain appears on three independent security blocklists and is referenced in one AlienVault OTX pulse. It is also blocked by PhishDestroy, MetaMask, and SEAL, suggesting that multiple remediation platforms have incorporated it into their protection feeds. While the observable infrastructure is well documented, the broader campaign details remain uncertain. No malware samples or phishing email artifacts have been publicly released, and the specific phishing kit used has not been identified. Attribution to a particular threat actor cannot be confirmed at this stage. Defenders should immediately add loginmicrosoft.com to deny‑list rules at network and email gateways, monitor DNS queries for the associated IP and nameservers, and enforce multi‑factor authentication for Microsoft accounts to mitigate credential harvesting. Continuous threat‑intel monitoring is advised to capture any emerging indicators related to this infrastructure.