Phishing detection: login.microsoftonline.cloud-authc.com

Microsoft
https://login.microsoftonline.cloud-authc.com Access site
Screenshot
Screenshot of login.microsoftonline.cloud-authc.com
Investigate
Domain login.microsoftonline.cloud-authc.com9 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 176.97.124.206
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://login.microsoftonline.cloud-authc.com
urlscan Wayback archive.today
Cert YE2
crt.sh Censys Google CT
Phishunt analysis Beta
26 low suspicionheuristic risk score · not a probability
Why?
  • +6.1 Google Safe Browsing
  • +5.3 Keyword match
  • +4.0 Young domain
  • +2.2 Country mismatch
  • +1.1 ASN reputation
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.9 Young certificate
  • +0.9 No registrar lock
  • +0.7 Brand in cert SAN
  • +0.7 Unrecognised DNS provider
  • +0.6 Long domain
  • +0.6 Registrar reputation
  • +0.3 Free CA
  • +0.3 Deep subdomain
  • +0.2 Suspicious TLD
  • +0.1 Hyphens
20 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Fake Microsoft Online sign-in host nested under a look-alike authentication domain registered the same day. Mimics Microsoft login to steal account credentials. Hosted in Ukraine and flagged by Google Safe Browsing for social engineering.

Brand in cert SANYoung domainGoogle Safe Browsing
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-27 · confidence 85%
Domain & Network
Whois
Registrar Spaceship, Inc.
Network
IP 176.97.124.206
Country UkraineUkraine
Hosting Virtual Systems LLC
ASN AS6698
TLS Cert YE2
External detection Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Report this phishing
Brand owner Microsoft
phish@office365.microsoft.com Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-10-27 17:23 UTC  ·  Last refreshed 2026-10-28 23:30 UTC