Phishing alert: security-server-stat-06oa.bolt.host fake Microsoft account page

What happened

On 9 November 2026 the phishing-alert account @TheThreatWire posted on X that security-server-stat-06oa.bolt.host was hosting a phishing page impersonating Microsoft. In Phishing Alert #127 the post said hxxps://security-server-stat-06oa.bolt.host/ is a phishing page impersonating Microsoft account services such as Outlook and Microsoft 365 sign-in. The same host also appears on the Phishing Army blocklist. bolt.host is a shared hosting domain; only this subdomain is reported. The domain is not operated by Microsoft, and Microsoft is not involved.

How the scam works

Phishing pages like this are usually reached through a text message, email or search ad that claims there is a problem with an account, a payment or a delivery. The link opens a copy of the Microsoft sign-in or checkout screen on an address that has nothing to do with Microsoft. Anything typed into the form goes to whoever runs the page.

Criminals then use stolen logins to take over accounts, place orders or try the same password on other services, and card details can be used within minutes. Because the page can look almost identical to the real one, the safest check is the address bar: security-server-stat-06oa.bolt.host is not a Microsoft address.

Sign in to Microsoft services only at addresses you type yourself or through official apps. Anyone who entered details on security-server-stat-06oa.bolt.host should change the password through the official Microsoft app or website, enable two-step verification and contact their card issuer if payment details were entered. The indicators come from the post and have not been independently checked by scammers.com.

Source

Post by @TheThreatWire on X, 9 November 2026, flagging security-server-stat-06oa.bolt.host. Not independently verified by scammers.com.