Microsoft phishing & impersonation
Tech & Cloudoutlook.com
460
Sites impersonating it
189
New in the last 30 days
10
Campaigns
2026-11-14
Last detected
2026-08-172026-11-14
Where these sites are hosted
308 on free hosting platforms, 152 on 124 registered domains
replit.app · 84vercel.app · 82workers.dev · 28r2.dev · 22github.io · 17firebaseapp.com · 16.com · 73.net · 9.dev · 7.info · 4.me · 4.io · 3
Campaigns
Phishing kits we track as hunts, and how many of the sites below each one covers. A site can belong to more than one.
43 of 460 sites · last 2026-11-14
8 of 460 sites · last 2026-11-11
Fake Microsoft account code page that relays the victim's one-time code to the operator's servercritical
2 of 460 sites · last 2026-11-07
2 of 460 sites · last 2026-11-01
1 of 460 site · last 2026-11-09
Tech-support scam: fake security alert that locks the browser and asks you to call 'support'critical
1 of 460 site · last 2026-11-07
1 of 460 site · last 2026-10-17
1 of 460 site · last 2026-10-16
1 of 460 site · last 2026-10-13
1 of 460 site · last 2026-10-08
Official domains
outlook.comwindows.nets-microsoft.commicrosoftonline.usmcas.mssharepoint.commicrosoftonline.comoffice.commicrosoftmetrics.comlive.commicrosoftonline.cnmcas-gov.usaka.msmicrosoft365.comstatic.microsoftcloud.microsoftmicrosoftonline-p.comusgovcloud.microsoftmicrosoft.usmsauth.netmsftauth.netmcas-gov.msazure.comoffice365.commicrosoft.commsn.com
A match on a host outside these domains is recorded as impersonation. We look for the brand name in the address, page title and screenshot, its logo on a non-official site, and our AI analysis naming it.
Also known as
outlookonedrivehotmailoffice 365sharepointmicrosoft.comlive.comwindows securitywindows defendermicrosoft excelmicrosoft outlook / office 365microsoftonline.comoutlook / office 365owaoutlook web appmicrosoft outlook web app (owa)windows update
Sites impersonating Microsoft
50 of 460 sites · newest first · repeat scans of a site are grouped
37 lower-risk copies are not shown: sites that use the Microsoft name or design, but that neither our rule engine nor our AI analysis rates high risk (for example harmless copies of the brand's own pages). Show them
RulesLow RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
RulesHigh RiskAIHigh RiskPage sends data to a Telegram bot from disposable hosting“Microsoft” in the page titleAI analysis
RulesMaliciousAIConfirmed Scam“Microsoft” in the page titlePage text
RulesHigh RiskAIConfirmed ScamCredential Phishing on disposable hosting“Microsoft” in the page titlePage text
RulesMaliciousAIConfirmed Scam“Microsoft” in the hostnamePage text
bafybeibsqrtek2xohai4wovizdy53y4zwfvdpelrmeq7apktcqcoeecztu.ipfs. inbrowser. link Outlook Web App2026-11-13 · seen 23×RulesHigh RiskAIHigh RiskIDS: ET PHISHING Possible OWA Mail Phishing Landing - Title over non SSL“Microsoft” in the page titleAI analysisPage text
RulesMaliciousAIConfirmed Scam“Microsoft” in page or screenshot textScreenshot text
RulesHigh RiskAIConfirmed ScamMicrosoft logo on a non-official hostAI analysisLogo / faviconPage text
RulesLow RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
RulesMaliciousAIConfirmed ScamIDS: ET PHISHING PerSwaysion Phishkit Landing Page +6 more“Microsoft” in the page titlePage text
RulesMaliciousAIConfirmed ScamIDS: ET PHISHING PerSwaysion Phishkit Landing Page +6 more“Microsoft” in the page titlePage text
RulesMaliciousAIConfirmed ScamIDS: ET PHISHING PerSwaysion Phishkit Landing Page +6 more“Microsoft” in the page titlePage text
RulesMaliciousAIConfirmed ScamIDS: ET PHISHING PerSwaysion Phishkit Landing Page +6 more“Microsoft” in the page titlePage text
RulesHigh RiskAIConfirmed ScamIDS: ET PHISHING Microsoft Account Phishing Landing 2018-08-07 +1 more“Microsoft” in the page titleLogo / faviconPage text
RulesMaliciousAIConfirmed ScamIDS: ET PHISHING PerSwaysion Phishkit Landing Page +6 more“Microsoft” in the page titlePage text
RulesMaliciousAIConfirmed ScamIDS: ET PHISHING PerSwaysion Phishkit Landing Page +6 more“Microsoft” in the page titleAI analysisPage text
RulesLow RiskAIHigh Risk“Microsoft” in the hostnameAI analysis
RulesMaliciousAIHigh RiskMicrosoft 365 Credential PhishingMicrosoft logo on a non-official hostAI analysisLogo / favicon
RulesLow RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
RulesHigh RiskAIConfirmed ScamCredential Phishing on disposable hosting“Microsoft” in the page titlePage text
RulesLow RiskAIHigh Risk“Microsoft” in the page titleAI analysisPage text
RulesMaliciousAIConfirmed ScamMicrosoft Credential Phishing on cloud hosting“Microsoft” in page or screenshot textScreenshot text
logins-msn-365.hstn. me DNS Resolution Error - Domain Not Found, Or Domain not added to hosting account2026-11-12RulesHigh RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
RulesHigh RiskAIHigh RiskDevice-code phishing“Microsoft” in the page titleAI analysisScreenshot text
login-outlook365.yzz. me DNS Resolution Error - Domain Not Found, Or Domain not added to hosting account2026-11-12 · seen 6×RulesLow RiskAIHigh Risk“Microsoft” in the hostnameAI analysis
RulesMaliciousAIConfirmed Scam“Microsoft” in the hostnamePage text
RulesMaliciousAIConfirmed Scam“Microsoft” in the page titlePage text
RulesMaliciousAIConfirmed Scam“Microsoft” in the page titleLogo / faviconPage text
RulesMaliciousAIHigh Risk“Microsoft” in the hostnameAI analysis
l.ead. me 2026-11-11 · seen 2×RulesHigh RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
qrco.de 2026-11-11 · seen 2×RulesLow RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
pub-f7d0b25d29d147eda3a539e751281489.r2. dev 2026-11-11 · seen 2×RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — "Verifying site connection..." sc.php loader (hunting-rule content anchor) (turnstile-gate-kit-202609)Identified as Microsoft by our AI analysisAI analysis
RulesMaliciousAIConfirmed ScamIdentified as Microsoft by our AI analysisAI analysis
RulesHigh RiskAIHigh Risk“Microsoft” in the page titleAI analysisPage text
RulesHigh RiskAIConfirmed ScamCredential Phishing on disposable hosting“Microsoft” in the page titlePage text
RulesMaliciousAIConfirmed Scam“Microsoft” in the page titlePage text
RulesHigh RiskAIConfirmed ScamCredential Phishing on disposable hosting“Microsoft” in page or screenshot textScreenshot text
RulesMaliciousAIConfirmed ScamMicrosoft 365 Credential Phishing“Microsoft” in page or screenshot textScreenshot text
RulesLow RiskAIHigh Risk“Microsoft” in the page titleAI analysis
RulesMedium RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis- RulesHigh RiskAIHigh RiskKnown Kit: Self-hosted Turnstile gate kit — "Verifying site connection..." sc.php loader (hunting-rule content anchor) (turnstile-gate-kit-202609)Identified as Microsoft by our AI analysisAI analysis
RulesHigh RiskAIConfirmed ScamCredential Phishing on disposable hosting“Microsoft” in page or screenshot textScreenshot text
RulesLow RiskAIHigh Risk“Microsoft” in the page titleAI analysis
RulesMaliciousAIConfirmed Scam“Microsoft” in the hostnamePage text
RulesHigh RiskAIHigh Risk“Microsoft” in the hostnameAI analysis
RulesLow RiskAIHigh Risk“Microsoft” in the page titleAI analysis
RulesLow RiskAIHigh Risk“Microsoft” in the page titleIdentical page
RulesHigh RiskAIHigh Risk“Microsoft” in the page titleAI analysis
pub-61f37371db1d42afba13f23903b84152.r2. dev 2026-11-10 · seen 6×RulesLow RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
RulesLow RiskAIHigh Risk“Microsoft” in the page titleAI analysisPage text
101 further sites are not listed at all: the Microsoft name appeared on them, but we judged them not to be impersonation (both our rule engine and our AI analysis rated the page harmless, the page only mentions the brand, or it is a copy of another public website).