Phishing detection: microsoftquarantine.authorised-support.com

Microsoft
http://microsoftquarantine.authorised-support.com/login/review/wjy99urjpywk6fvppin_vx51xfx1jt7x1ueq=7bg==/qvl0fnmnyahdj2smoxwxeggfe1toi_hb Access site
Screenshot
Screenshot of microsoftquarantine.authorised-support.com
Investigate
Domain microsoftquarantine.authorised-support.com1 CT host on apex
urlscan page.domain VirusTotal Whois
IP 3.174.46.92
urlscan page.ip VirusTotal ipinfo Greynoise
URL http://microsoftquarantine.authorised-support.com/login/rev…
urlscan Wayback archive.today
Cert Amazon RSA 2048 M02
crt.sh Censys Google CT
Phishunt analysis Beta
34 medium suspicion suspiciousheuristic risk score · not a probability
Keyword matchLong domainHigh entropy
21 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting

Site references Microsoft and email quarantine in its domain to simulate a security alert, routing users through obfuscated login paths on a fraudulent support domain. It is flagged by Google Safe Browsing, OpenPhish, and urlscan, and hosted on AWS in Germany.

Brand impersonation in pathGoogle Safe BrowsingCredential path
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-23 · confidence 91%
Domain & Network
Whois
Registrar GoDaddy.com, LLC
Network
IP 3.174.46.92
Country GermanyGermany
Hosting Amazon.com, Inc.
ASN AS16509
TLS Cert Amazon RSA 2048 M02
External detection Google Safe Browsing OpenPhish urlscan.io
GSB category: SOCIAL_ENGINEERING
CleanPhishTank · TweetFeed
Related infrastructure Betasuspected links from shared infrastructure, not attribution
Suspected cluster #188 · 3 indicators · confidence Medium · targets: Microsoft, PayPal
microsoft.authorised-support.com 60 same apex same nameservers same redirect target similar name same TLS cert shared TLS SAN
active 2026-05-15
paypal.cardpaysecurity.org 48 same redirect target same TLS cert shared TLS SAN same screenshot
active 2026-05-14
microsoft.account.trustedentity.com 36 similar text same redirect target same screenshot
active 2026-05-13
Top 3 of 3 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Report this phishing
Network / ASN Amazon.com, Inc.
abuse@amazonaws.com Web form
Registrar GoDaddy.com, LLC
abuse@godaddy.com Web form
Brand owner Microsoft
phish@office365.microsoft.com Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-05-12 01:01 UTC  ·  Last refreshed 2026-08-03 07:30 UTC