portal-login-access[.]net

This domain, portal-login-access.net, operates as a fraudulent Microsoft login portal designed to harvest user credentials. The site mimics the legitimate Microsoft account sign-in page, presenting a near-identical interface to deceive visitors into entering their usernames and passwords. Once submitted, these credentials are captured by threat actors and can be exploited for unauthorized access to email accounts, cloud storage, corporate networks, or other linked services. The risk is elevated due to the domain’s convincing appearance and the high-value target it impersonates, which increases the likelihood of successful compromise for individuals unfamiliar with phishing indicators. Analysis indicates the domain was registered on January 7, 2026, through GoDaddy.com, LLC, a widely used registrar that has been frequently leveraged by threat actors for malicious infrastructure. The domain resolves to the IP address 172.174.53.244, which is hosted under AS8075, an autonomous system associated with Microsoft Corporation. However, this does not imply legitimacy, as the IP is likely part of a cloud or hosting environment abused for malicious purposes. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. Detection data from VirusTotal reveals that 23 out of 95 security vendors flag the domain as malicious, confirming its classification as a phishing resource. Additionally, the domain appears on one security blocklist and has been proactively blocked by at least one anti-phishing system. Individuals who visited portal-login-access.net and entered their credentials should take immediate action to mitigate potential compromise. First, change the password for the affected Microsoft account and any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to add an additional layer of security. Monitor the account for suspicious activity, such as unauthorized login attempts, sent emails, or changes to security settings. If the account is linked to corporate or sensitive data, notify the relevant IT or security team to conduct a thorough review. Finally, consider scanning the device used to access the site for malware, as phishing pages may redirect to or host additional malicious payloads. The domain has since been taken offline, but users should remain vigilant for similar threats targeting Microsoft or other trusted brands.