signin[.]officeloginportals[.]com

This domain, signin.officeloginportals.com, is actively flagged as a high-risk credential phishing resource targeting Microsoft 365 login credentials. Registered on October 16, 2025, through Global Domain Group LLC, the domain currently resolves to IP address 172.67.147.230, hosted on Cloudflare's infrastructure (AS13335). Nameservers heidi.ns.cloudflare.com and memphis.ns.cloudflare.com confirm Cloudflare's role in DNS resolution, which is commonly leveraged to obscure hosting origins and evade takedowns. The domain is detected by 13 of 95 security vendors on VirusTotal, indicating moderate but not universal recognition as malicious. A single security blocklist currently lists the domain, and it is actively blocked by at least one anti-phishing service. The HTTP response code 403 suggests the server is configured to deny direct access, potentially as a measure to evade automated crawlers or security scans. The page title 'Nur einen Moment…' is consistent with Cloudflare's interstitial challenge pages, which may be presented to visitors before redirecting to the actual phishing content. The SSL certificate, issued by Google Trust Services (WE1), is valid and does not inherently indicate compromise, though it is commonly used in both legitimate and malicious infrastructure. Defenders should treat this domain as an active threat. The combination of Microsoft 365-themed subdomains, Cloudflare hosting, and credential phishing classification presents a clear risk to enterprise users. Immediate blocking at the DNS and network layer is recommended. Further analysis of associated infrastructure, such as co-hosted domains or linked redirect chains, may reveal additional malicious resources. Given the domain's age and active status, it is likely part of a broader, ongoing campaign rather than an isolated incident.