crosss[.]top

This domain, crosss.top, has been identified as an active credential harvesting platform designed to impersonate Microsoft authentication portals. Analysis indicates the site presents fraudulent login interfaces to deceive users into submitting account credentials, which are subsequently exfiltrated to attacker-controlled infrastructure. The domain remains operational as of the latest verification and has not yet been widely flagged by security vendors. Infrastructure analysis reveals the domain was registered on December 25, 2024, through Hosting Concepts B.V. d/b/a Registrar.eu, a registrar frequently observed in phishing operations. The domain resolves to the IP address 86.107.77.32, which has not been previously associated with confirmed malicious activity in public threat feeds. As of the most recent scan, the domain has been flagged by 0 of 95 vendors on VirusTotal, indicating limited detection coverage despite its confirmed malicious purpose. The site employs a Let's Encrypt SSL certificate, providing a false sense of security to potential victims. Current status confirms the domain remains active and operational, with no evidence of takedown or mitigation efforts. Organizations are advised to implement immediate network-level blocking of crosss.top and the associated IP 86.107.77.32. Security teams should monitor for credential submission attempts to this domain and conduct internal investigations for any compromised accounts. End users should be educated to verify domain authenticity before entering credentials, particularly when redirected from unexpected sources. Given the domain's recent registration and lack of detection, proactive monitoring of newly registered domains with similar characteristics is recommended to identify related threats.