Phishing detection: microsoft.vpn-update.org

Microsoft
https://microsoft.vpn-update.org Access site
Screenshot
No screenshot available yet Captured automatically on the next refresh cycle
Investigate
Domain microsoft.vpn-update.org6 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 159.246.29.210
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://microsoft.vpn-update.org
urlscan Wayback archive.today
Cert -
crt.sh Censys Google CT
Phishunt analysis Beta
19 noiseheuristic risk score · not a probability
Keyword matchBrand in subdomainBrand + login token
14 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting

Domain combining Microsoft branding with a VPN-update theme, flagged by Google Safe Browsing as social engineering. The site redirects visitors to Google, a cloaking behavior used to evade analysis while serving malicious content to targeted users.

Brand + login tokenGoogle Safe BrowsingFinal host mismatch
AI-generated from stored detector signals - the AI never visited the site. · 2026-08-09 · confidence 62%
Domain & Network
Whois
Registrar Tucows Domains Inc.
Network
IP 159.246.29.210
Country United StatesUnited States
Hosting Crowe LLP
ASN AS30491
TLS Cert -
External detection Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Related infrastructure Betasuspected links from shared infrastructure, not attribution
microsoft.berlin 26 same nameservers similar name
active 2026-07-28
Top 1 of 1 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Report this phishing
Brand owner Microsoft
phish@office365.microsoft.com Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-08-09 05:25 UTC  ·  Last refreshed 2026-08-11 01:30 UTC