Microsoft phishing & impersonation
Tech & Cloudoutlook.com
460
Sites impersonating it
189
New in the last 30 days
0
Campaigns
2026-11-14
Last detected
Official domains
outlook.comwindows.nets-microsoft.commicrosoftonline.usmcas.mssharepoint.commicrosoftonline.comoffice.commicrosoftmetrics.comlive.commicrosoftonline.cnmcas-gov.usaka.msmicrosoft365.comstatic.microsoftcloud.microsoftmicrosoftonline-p.comusgovcloud.microsoftmicrosoft.usmsauth.netmsftauth.netmcas-gov.msazure.comoffice365.commicrosoft.commsn.com
A match on a host outside these domains is recorded as impersonation. We look for the brand name in the address, page title and screenshot, its logo on a non-official site, and our AI analysis naming it.
Also known as
outlookonedrivehotmailoffice 365sharepointmicrosoft.comlive.comwindows securitywindows defendermicrosoft excelmicrosoft outlook / office 365microsoftonline.comoutlook / office 365owaoutlook web appmicrosoft outlook web app (owa)windows update
Sites impersonating Microsoft
50 of 460 sites · newest first · repeat scans of a site are grouped
37 lower-risk copies are not shown: sites that use the Microsoft name or design, but that neither our rule engine nor our AI analysis rates high risk (for example harmless copies of the brand's own pages). Show them
RulesHigh RiskAIConfirmed ScamPossible Microsoft 365 PhishingMicrosoft logo on a non-official hostLogo / favicon
RulesMaliciousAIConfirmed Scam“Microsoft” in page or screenshot textScreenshot text
RulesHigh RiskAIHigh RiskPage sends data to a Telegram bot from disposable hostingIdentified as Microsoft by our AI analysisAI analysis
RulesHigh RiskAIHigh RiskPage sends data to a Telegram bot from disposable hostingIdentified as Microsoft by our AI analysisAI analysis
RulesMaliciousAIConfirmed ScamKnown Kit: Fake Microsoft account code page that relays the victim's one-time code to the operator's server (ms-account-otp-relay-2026-11)“Microsoft” in page or screenshot textScreenshot text
RulesLow RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis- RulesHigh RiskAIHigh RiskDevice-code phishing“Microsoft” in the page titleIdentical page
RulesLow RiskAIHigh Risk“Microsoft” in the page titleAI analysis
RulesLow RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
RulesLow RiskAIConfirmed Scam“Microsoft” in page or screenshot textScreenshot text
RulesMedium RiskAIConfirmed Scam“Microsoft” in the page titleAI analysisPage text
RulesLow RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
RulesMaliciousAIConfirmed Scam“Microsoft” in the hostnameIdentical pageScreenshot text
RulesHigh RiskAIHigh RiskIDS: ET PHISHING Microsoft Account Phishing Landing 2018-08-07 +1 more“Microsoft” in the hostnameAI analysis
RulesMaliciousAIConfirmed Scam“Microsoft” in the hostnameScreenshot text
RulesHigh RiskAIConfirmed ScamCredential Phishing on disposable hosting“Microsoft” in the page titlePage text
RulesLow RiskAIHigh Risk“Microsoft” in the page titleAI analysis
RulesHigh RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
RulesMedium RiskAIConfirmed Scam“Microsoft” in the page titlePage text
RulesMaliciousAIConfirmed ScamIdentified as Microsoft by our AI analysisAI analysis
RulesMaliciousAIConfirmed Scam“Microsoft” in the hostnameAI analysis
RulesMaliciousAIConfirmed Scam“Microsoft” in the page titlePage text
RulesLow RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
RulesLow RiskAIHigh Risk“Microsoft” in the page titleAI analysis
RulesMedium RiskAIHigh Risk“Microsoft” in the page titleAI analysisPage text
RulesLow RiskAIHigh Risk“Microsoft” in the page titleAI analysis
login.keyshopes. top 2026-11-03RulesLow RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
RulesMaliciousAIConfirmed ScamMicrosoft logo on a non-official hostLogo / favicon
RulesHigh RiskAIHigh Risk“Microsoft” in the hostnameAI analysis
RulesLow RiskAIConfirmed Scam“Microsoft” in page or screenshot textScreenshot text
RulesLow RiskAIHigh Risk“Microsoft” in the hostnameAI analysis
RulesLow RiskAIHigh Risk“Microsoft” in the hostnameAI analysis
RulesHigh RiskAIConfirmed ScamCredential Phishing on disposable hosting“Microsoft” in page or screenshot textScreenshot text
RulesHigh RiskAIHigh Risk“Microsoft” in the page titleAI analysis
RulesLow RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
RulesMaliciousAIConfirmed Scam“Microsoft” in the page titlePage text
dotnet.microsofth. com 2026-11-02RulesMaliciousAIConfirmed Scam“Microsoft” in the hostnameAI analysis
help.microsofth. com 2026-11-02RulesMaliciousAIHigh Risk“Microsoft” in the hostnameAI analysis
edge.microsofth. com 2026-11-02RulesMaliciousAIHigh Risk“Microsoft” in the hostnameAI analysis
data.microsofth. com 2026-11-02RulesMaliciousAIConfirmed Scam“Microsoft” in the hostnameAI analysis
apps.microsofth. com 2026-11-02RulesMaliciousAIHigh Risk“Microsoft” in the hostnameAI analysis
auth.microsofth. com 2026-11-02RulesMaliciousAIHigh Risk“Microsoft” in the hostnameAI analysis
RulesLow RiskAIHigh Risk“Microsoft” in the hostnameAI analysis
RulesMaliciousAIHigh RiskKnown Kit: Chinese-language fake software download sites handing out archives from Aliyun OSS Hong Kong buckets (Microsoft Teams, WinRAR, NetEase Cloud Music, Soda Music and others) (cn-oss-fake-software-2026-11)“Microsoft” in the page titleAI analysis
RulesMaliciousAIHigh RiskKnown Kit: Chinese-language fake software download sites handing out archives from Aliyun OSS Hong Kong buckets (Microsoft Teams, WinRAR, NetEase Cloud Music, Soda Music and others) (cn-oss-fake-software-2026-11)“Microsoft” in the page titleAI analysis
RulesMaliciousAIConfirmed Scam“Microsoft” in the hostnamePage text
RulesHigh RiskAIHigh Risk“Microsoft” in the page titleAI analysis
RulesMaliciousAIConfirmed ScamIdentified as Microsoft by our AI analysisAI analysisIdentical page
RulesMedium RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
RulesLow RiskAIHigh RiskIdentified as Microsoft by our AI analysisAI analysis
101 further sites are not listed at all: the Microsoft name appeared on them, but we judged them not to be impersonation (both our rule engine and our AI analysis rated the page harmless, the page only mentions the brand, or it is a copy of another public website).