login.microsoftonline.com
Classification: Whitelisted
login.microsoftonline.com is a whitelisted (trusted) hostname. Reported by 5 threat sources, last seen 2026-08-18.
Current activity
- Online — resolving/reachable. Last checked 2026-09-01 09:16:27.
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Suspicious URL | Triage | 2026-05-01 17:56:33 | 2026-08-18 22:00:42 | anomalous-activity malicious-activity | |
| Malicious URL | Triage | 2026-02-06 19:04:27 | 2026-04-21 01:56:09 | malicious-activity | |
| Top Popularity Site | Cisco Umbrella | 2022-07-18 20:31:20 | 2026-03-20 00:02:05 | benign | |
| Microsoft phishing | Maltiverse | 2025-10-08 10:18:28 | 2025-11-05 02:46:03 | malicious-activity | T1566 Phishing |
| Malicious URL | Hybrid-Analysis | 2023-08-31 21:00:04 | 2023-08-31 21:00:04 | ||
| Safe Site | Cisco Umbrella | 2022-07-14 23:25:07 | 2022-07-16 01:15:07 | benign | |
| Safe Site | Maltiverse Research Team | 2022-07-11 22:43:24 | 2022-07-11 22:43:24 | ||
| Malware | Hybrid-Analysis | 2021-06-01 20:45:10 | 2022-01-15 07:30:09 | ||
| Malicious site | Hybrid-Analysis | 2018-07-31 09:17:30 | 2022-01-15 00:15:17 | ||
| Phishing site | Hybrid-Analysis | 2018-07-18 12:16:01 | 2022-01-12 18:45:42 | ||
| Trojan.GenAsa | Hybrid-Analysis | 2021-12-30 19:15:12 | 2021-12-30 19:15:12 | ||
| Malware.Generic | Hybrid-Analysis | 2020-01-11 17:00:14 | 2021-12-29 17:00:56 | ||
| Malware site | Hybrid-Analysis | 2018-08-09 16:45:11 | 2021-12-26 20:15:06 | ||
| Exploit | Hybrid-Analysis | 2020-07-23 17:30:05 | 2021-12-14 07:15:29 | ||
| Trojan.Script.Generic | Hybrid-Analysis | 2021-12-10 09:15:07 | 2021-12-10 09:15:07 | ||
| Phishing.Gen | Hybrid-Analysis | 2021-12-03 21:17:09 | 2021-12-03 21:17:09 | ||
| IL:Trojan.MSILZilla | Hybrid-Analysis | 2021-11-23 10:30:58 | 2021-11-23 10:30:58 | ||
| Trojan.HTML.Agent | Hybrid-Analysis | 2021-08-03 09:15:11 | 2021-08-03 09:15:11 | ||
| Probably Heur.HTMLUnescape | Hybrid-Analysis | 2020-04-02 16:30:15 | 2021-07-27 15:15:19 | ||
| Generic.Malware | Hybrid-Analysis | 2018-04-19 13:30:11 | 2021-04-26 16:45:05 | ||
| Phish.HHH | Hybrid-Analysis | 2021-04-26 16:00:23 | 2021-04-26 16:00:23 | ||
| JS:Trojan.Cryxos | Hybrid-Analysis | 2020-11-09 21:45:10 | 2021-04-14 20:30:29 | ||
| VB.Heur2.EmoDldr.16.03FEBDBF | Hybrid-Analysis | 2021-03-29 14:31:45 | 2021-03-29 14:31:45 | ||
| Trojan.Adload.a | Hybrid-Analysis | 2021-03-15 00:00:18 | 2021-03-15 00:00:18 | ||
| CVE-2017-11882 | Hybrid-Analysis | 2020-11-18 20:15:17 | 2020-11-18 20:15:17 | ||
| Trojan.HTML.PHISH | Hybrid-Analysis | 2020-09-18 18:15:52 | 2020-09-18 18:15:52 | ||
| Trojan.Generic | Hybrid-Analysis | 2019-03-01 10:00:13 | 2020-08-28 11:45:09 | ||
| HEUR.VBA.Trojan | Hybrid-Analysis | 2020-07-22 21:15:07 | 2020-07-22 21:15:07 | ||
| Trojan.VBA | Hybrid-Analysis | 2020-07-22 13:00:25 | 2020-07-22 13:00:25 | ||
| Trojan.Ole2.Vbs | Hybrid-Analysis | 2020-07-17 15:01:01 | 2020-07-17 15:01:01 | ||
| AdWare.TOVus | Hybrid-Analysis | 2020-07-15 20:45:09 | 2020-07-15 20:45:09 | ||
| VB.Dropper.1 | Hybrid-Analysis | 2020-07-06 11:00:16 | 2020-07-06 11:00:16 | ||
| Hoax.JS.Phish | Hybrid-Analysis | 2020-04-24 16:46:02 | 2020-06-15 16:30:49 | ||
| Gen:NN.ZemsilF.34128 | Hybrid-Analysis | 2020-06-12 18:17:29 | 2020-06-12 18:17:29 | ||
| W32.Trojan | Hybrid-Analysis | 2020-04-22 00:45:19 | 2020-06-03 17:30:34 | ||
| XLM.Trojan.Abracadabra.1 | Hybrid-Analysis | 2020-05-20 17:30:18 | 2020-06-02 03:45:09 | ||
| Trojan.Script.ExpKit | Hybrid-Analysis | 2020-05-20 20:15:04 | 2020-05-20 20:15:04 | ||
| Alexa Top 1 Million | Maltiverse Research Team | 2020-05-14 10:26:08 | 2020-05-14 10:26:08 | ||
| Generic.MSIL.PasswordStealerA | Hybrid-Analysis | 2020-05-06 03:15:14 | 2020-05-06 03:15:14 | ||
| Virus.3DMax.Script | Hybrid-Analysis | 2020-05-05 15:00:54 | 2020-05-05 15:00:54 | ||
| GenericKDZ.6570 | Hybrid-Analysis | 2020-03-31 02:15:08 | 2020-03-31 02:15:08 | ||
| NSIS:Relevant | Hybrid-Analysis | 2020-03-25 21:30:23 | 2020-03-25 21:30:23 | ||
| Program.Unwanted | Hybrid-Analysis | 2020-02-04 20:17:04 | 2020-02-04 20:17:04 | ||
| Virus.Sality | Hybrid-Analysis | 2020-01-08 13:00:19 | 2020-01-08 13:00:19 | ||
| Gen:NN.ZexaF.32515 | Hybrid-Analysis | 2019-11-26 12:15:04 | 2019-11-26 12:15:04 | ||
| Gen:NN.ZexaF.32253 | Hybrid-Analysis | 2019-11-22 03:15:04 | 2019-11-25 09:45:06 | ||
| Gen:NN.ZexaF.32253.iu0@auU13 | Hybrid-Analysis | 2019-11-23 09:00:05 | 2019-11-23 09:00:05 | ||
| Phishing.DOC | Hybrid-Analysis | 2019-11-14 11:45:09 | 2019-11-14 11:45:09 | ||
| Phish | Hybrid-Analysis | 2019-07-17 19:30:10 | 2019-11-07 18:30:09 | ||
| Oneeva.A | Hybrid-Analysis | 2019-08-19 06:15:08 | 2019-08-19 06:15:08 | ||
| Phishing.g | Hybrid-Analysis | 2019-08-15 20:15:19 | 2019-08-15 22:30:08 | ||
| Phishing.JO | Hybrid-Analysis | 2019-08-07 20:30:07 | 2019-08-07 20:30:07 | ||
| HEUR:Trojan.MSIL.Agent | Hybrid-Analysis | 2019-07-23 02:00:57 | 2019-07-23 02:15:06 | ||
| virus.office.obfuscated | Hybrid-Analysis | 2019-06-12 07:45:14 | 2019-06-12 07:45:14 | ||
| HTML:RedirME | Hybrid-Analysis | 2019-06-03 06:15:09 | 2019-06-10 14:15:28 | ||
| Virus.Expiro | Hybrid-Analysis | 2019-06-07 21:30:42 | 2019-06-07 22:01:56 | ||
| Agent.9ACA | Hybrid-Analysis | 2019-06-06 22:00:10 | 2019-06-07 21:30:23 | ||
| MSOffice.Agent | Hybrid-Analysis | 2019-03-18 20:15:49 | 2019-05-16 13:45:06 | ||
| BehavesLike.Generic | Hybrid-Analysis | 2019-05-05 21:00:16 | 2019-05-05 21:00:16 | ||
| DeepScan:Generic.Ransom.GandCrab5 | Hybrid-Analysis | 2019-03-15 05:15:34 | 2019-03-15 05:15:34 | ||
| Gen:Variant.Razy | Hybrid-Analysis | 2018-05-28 01:30:28 | 2019-03-15 05:00:08 | ||
| Gen:Heur.Ransom.REntS.Gen | Hybrid-Analysis | 2019-03-02 19:00:16 | 2019-03-02 19:00:16 | ||
| DDEExec.A | Hybrid-Analysis | 2019-01-22 13:15:42 | 2019-01-22 13:15:42 | ||
| VB:Trojan.Valyria | Hybrid-Analysis | 2018-12-22 22:00:11 | 2018-12-22 22:00:11 | ||
| Heuristic | Hybrid-Analysis | 2018-09-08 09:45:07 | 2018-09-08 09:45:07 | ||
| Heur.Corrupt | Hybrid-Analysis | 2018-07-06 01:00:30 | 2018-07-06 01:00:30 | ||
| Ransom_Purgen.R007C0OJC17 | Hybrid-Analysis | 2018-05-01 14:30:35 | 2018-05-01 14:30:35 | ||
| DangerousObject.Multi | Hybrid-Analysis | 2018-04-17 04:45:19 | 2018-04-17 04:45:19 | ||
| evasive | Maltiverse | 2018-01-15 07:19:53 | 2018-03-13 10:34:30 | ||
| exploit,financial,retefe,trojan | Maltiverse | 2018-01-04 19:48:10 | 2018-01-04 19:48:10 | ||
| exploit | Maltiverse | 2017-12-27 11:26:40 | 2017-12-27 11:26:40 | ||
| phishing | Maltiverse | 2017-12-01 17:16:55 | 2017-12-01 17:16:55 |
Tags
phishing evasive defense_evasion discovery microsoft backdoor persistence privilege_escalation ransomware rat onedrive genericcloudflare macos google generic genericemail owa adobe govau docusign sharepointIP addresses resolved by this hostname
- 40.126.28.14 (2024-09-04 10:13:37)
- 40.126.28.18 (2024-09-04 10:13:37)
- 40.126.29.6 (2024-09-04 08:40:10)
- 40.126.29.5 (2024-09-04 08:40:10)
- 40.126.29.9 (2024-09-04 08:40:10)
- 40.126.29.10 (2024-09-04 08:40:10)
- 40.126.28.13 (2024-09-04 10:13:37)
- 40.126.28.22 (2024-09-04 08:31:04)
- 23.100.72.34 (2018-03-13 10:34:30)
- 65.52.1.17 (2018-03-13 10:34:30)
- 65.52.1.16 (2018-03-13 10:34:30)
- 65.52.193.137 (2017-12-01 17:16:56)
- 65.52.193.138 (2017-12-01 17:16:56)
- 65.52.193.136 (2018-03-13 10:34:30)
- 23.100.72.33 (2017-12-01 17:16:56)
- 65.52.1.18 (2018-03-13 10:34:30)
- 40.84.199.233 (2019-12-13 09:26:44)
- 52.178.167.109 (2019-12-13 09:26:44)
- 64.4.6.100 (2015-01-11 00:00:00)
- 65.55.171.171 (2013-09-10 00:00:00)
- 65.55.39.10 (2015-01-14 00:00:00)
- 20.190.159.68 (2025-02-14 06:03:53)
- 20.190.160.67 (2025-02-15 01:31:04)
- 40.126.7.35 (2025-03-01 01:23:11)
- 40.126.7.32 (2025-03-01 01:23:11)
- 40.126.28.11 (2025-03-01 01:23:11)
- 40.126.28.20 (2025-03-01 01:23:11)
- 40.126.28.21 (2025-03-01 01:23:11)
- 20.190.135.2 (2025-03-01 01:23:11)
- 40.126.28.12 (2025-03-01 01:23:11)
- 40.126.28.23 (2025-03-01 01:23:11)
- 20.190.160.5 (2025-04-06 00:01:23)
- 20.190.160.3 (2025-05-10 01:15:13)
- 2603:1026:3000:d0::d (2025-05-10 01:15:13)
- 2603:1026:3000:d8::2 (2025-05-10 01:15:13)
- 20.190.160.130 (2025-05-10 01:15:13)
- 40.126.32.76 (2025-05-17 01:15:21)
- 20.190.160.22 (2025-05-17 01:15:21)
- 40.126.32.134 (2025-05-17 01:15:21)
- 2603:1026:3000:d0:: (2025-05-17 01:15:21)
- 2603:1027:1:c8::3 (2025-05-17 01:15:21)
- 20.190.160.20 (2025-05-17 01:15:21)
- 20.190.160.64 (2025-05-17 01:15:21)
- 2603:1026:3000:158::4 (2025-05-24 01:18:39)
- 20.190.159.73 (2025-05-24 01:18:39)
- 40.126.31.71 (2025-05-24 01:18:39)
- 40.126.31.67 (2025-05-24 14:52:06)
- 2603:1026:3000:148::e (2025-05-24 14:52:06)
- 2603:1026:3000:158::2 (2025-05-24 14:52:06)
- 2603:1026:3000:148::6 (2025-05-24 14:52:06)
- 2603:1026:3000:150::6 (2025-05-24 14:52:06)
- 20.190.160.128 (2025-10-08 17:56:36)
- 2603:1027:1:148::5 (2025-10-08 17:56:36)
- 2603:1026:3000:158::5 (2025-10-08 17:56:36)
- 2603:1027:1:150::3 (2025-10-08 17:56:36)
- 2603:1027:1:158::2 (2025-10-08 17:56:36)
- 20.190.160.132 (2025-10-08 17:56:36)
- 2603:1027:1:158::c (2025-10-08 17:56:36)
- 20.190.160.2 (2025-10-08 17:56:36)
- 2603:1027:1:158::a (2025-10-08 17:56:36)
- 20.190.160.4 (2025-10-08 17:56:36)
- 2603:1026:3000:150::5 (2026-02-07 00:03:56)
- 20.190.159.131 (2026-02-07 00:03:56)
- 20.190.159.130 (2026-02-07 00:03:56)
- 40.126.31.1 (2026-02-07 00:03:56)
- 20.190.159.0 (2026-02-07 00:03:56)
- 40.126.31.73 (2026-02-07 00:03:56)
- 2603:1027:1:150::5 (2026-02-07 00:03:56)
- 2603:1026:3000:150::c (2026-02-07 00:03:56)
- 40.126.32.136 (2026-03-20 00:02:04)
- 20.190.160.17 (2026-03-20 00:02:04)
- 20.190.160.66 (2026-03-20 00:02:04)
- 2603:1027:1:c8::1 (2026-03-20 00:02:04)
- 40.126.32.140 (2026-03-20 00:02:04)
- 2603:1027:1:d0::3 (2026-03-20 00:02:04)
- 2603:1027:1:d0::4 (2026-03-20 00:02:04)
- 2603:1027:1:c8:: (2026-03-20 00:02:04)
- 2603:1026:3000:d8::1 (2026-03-20 00:02:04)
- 40.126.32.74 (2026-03-20 00:02:04)
- 40.126.32.68 (2026-03-20 00:02:04)
- 20.190.160.131 (2026-03-20 00:02:04)
- 40.126.32.138 (2026-03-20 00:02:04)
- 2603:1027:1:d8::4 (2026-04-21 00:02:51)
- 40.126.31.129 (2026-04-21 00:02:51)
- 2603:1027:1:d0::5 (2026-04-21 00:02:51)
- 2603:1027:1:d8::5 (2026-04-21 00:02:51)
- 20.190.159.64 (2026-04-21 00:02:51)
- 20.190.159.129 (2026-04-21 00:02:51)
- 20.190.159.2 (2026-04-21 00:02:51)
- 2603:1026:3000:d0::b (2026-04-21 00:02:51)
- 2603:1027:1:d8::7 (2026-04-21 00:02:51)
- 2603:1026:3000:d0::9 (2026-04-21 00:02:51)
- 2603:1027:1:d0::6 (2026-04-21 00:02:51)
- 40.126.31.130 (2026-04-21 00:02:51)
- 2603:1027:1:150::4 (2026-05-28 15:48:52)
- 2603:1026:3000:158::3 (2026-05-28 15:48:52)
- 2603:1027:1:158::8 (2026-05-28 15:48:52)
- 2603:1026:3000:148::7 (2026-05-28 15:48:52)
- 20.190.157.12 (2026-05-28 15:48:52)
- 2603:1027:1:148::4 (2026-05-28 15:48:52)
- 2603:1027:1:150::2 (2026-05-28 15:48:52)
- 20.190.157.14 (2026-05-28 15:48:52)
- 2603:1027:1:148::f (2026-05-28 15:48:52)
- 2603:1026:3000:150::a (2026-05-28 15:48:52)
- 40.126.29.8 (2026-05-28 15:48:52)
- 40.126.29.13 (2026-05-28 15:48:52)
- 40.126.29.14 (2026-05-28 15:48:52)
- 20.190.157.3 (2026-05-28 15:48:52)
- 20.190.157.11 (2026-05-28 15:48:52)
- 40.126.29.15 (2026-05-28 15:48:52)
- 20.190.159.71 (2026-09-01 09:16:27)
- 2603:1026:3000:c8::7 (2026-09-01 09:16:27)
- 2603:1026:3000:d8::3 (2026-09-01 09:16:27)
- 40.126.31.3 (2026-09-01 09:16:27)
- 20.190.159.128 (2026-09-01 09:16:27)
- 20.190.159.75 (2026-09-01 09:16:27)
- 40.126.31.0 (2026-09-01 09:16:27)
- 2603:1026:3000:c8::b (2026-09-01 09:16:27)
- 2603:1027:1:d8::9 (2026-09-01 09:16:27)
- 2603:1026:3000:c8::6 (2026-09-01 09:16:27)
- 20.190.159.23 (2026-09-01 09:16:27)
- 2603:1026:3000:c8::9 (2026-09-01 09:16:27)
- 40.126.31.69 (2026-09-01 09:16:27)
- 2603:1026:3000:d8:: (2026-09-01 09:16:27)
- 2603:1026:3000:d0::6 (2026-09-01 09:16:27)
- 20.190.159.4 (2026-09-01 09:16:27)
Whois information
- Domain
- microsoftonline.com
- TLD
- com
- DNSSEC
- ['unsigned']
- Nameservers
- NS1-38.AZURE-DNS.COM, NS2-38.AZURE-DNS.NET, NS3-38.AZURE-DNS.ORG, NS4-38.AZURE-DNS.INFO, ns2-38.azure-dns.net, ns3-38.azure-dns.org, ns4-38.azure-dns.info, ns1-38.azure-dns.com, NS1.MSFT.NET, NS1A.O365FILTERING.COM, NS2.MSFT.NET, NS2A.O365FILTERING.COM, NS3.MSFT.NET, NS3A.O365FILTERING.COM, NS4.MSFT.NET, NS4A.O365FILTERING.COM, ns4a.o365filtering.com, ns4.msft.net, ns3.msft.net, ns3a.o365filtering.com, ns2a.o365filtering.com, ns1a.o365filtering.com, ns1.msft.net, ns2.msft.net
- Whois server
- whois.markmonitor.com
- Registrant
- MarkMonitor, Inc.
- Address
- One Microsoft Way,
- City
- Redmond
- State
- WA
- Country
- US — United States 🇺🇸
- Contact email
- [email protected], [email protected], [email protected], [email protected]
- Domain created
- 2002-07-09 19:27:26
- Domain expires
- 2027-07-09 19:33:05
- First indexed
- 2017-12-01 17:16:55
- Last updated
- 2026-09-01 09:16:28