lb5831[.]craftum[.]io

PhishDestroy has identified lb5831.craftum.io as a confirmed phishing site targeting Microsoft SharePoint Online users. This domain was designed to impersonate the legitimate SharePoint file-sharing interface, tricking victims into entering their credentials or downloading malicious payloads. The page title, "Pending File-SharePoint Online," is a clear attempt to deceive users into believing they are accessing a legitimate Microsoft service.

Technical analysis reveals that lb5831.craftum.io has been flagged by 20 out of 95 security vendors on VirusTotal, indicating widespread recognition as malicious. The domain was registered through Regional Network Information Center, JSC dba RU-CENTER and resolves to IP address 92.255.111.71. It was created on February 21, 2026, and uses an SSL certificate issued by GlobalSign nv-sa / GlobalSign GCC R3 DV TLS CA 2020, which is a common tactic to appear legitimate. Additionally, the domain appears on one security blocklist, and Google Safe Browsing has likely flagged it, though the current status shows it has been taken offline.

As of the latest check, lb5831.craftum.io is offline, suggesting that hosting providers or authorities have intervened to disrupt the phishing operation. However, the domain may still pose residual risks if it becomes active again or if similar domains are deployed. Users who may have interacted with this site should change their SharePoint passwords immediately and enable multi-factor authentication. PhishDestroy recommends avoiding any unsolicited file-sharing requests and verifying URLs before entering credentials.