microsofteaminvites[.]top

microsofteaminvites.top entered the PhishDestroy evidence set on Jul 3, 2026. The hostname explicitly references Microsoft; stored content metadata identifies the same apparent target. The assembled evidence scores 71/100 (high).

Three independent sources are positive: MetaMask, SEAL, and URLQuery. MetaMask and SEAL listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 18:20 UTC. URLQuery recorded 2 detections. The evidence is not unanimous. VirusTotal recorded 0 detections among 91 engines on Jul 3, 2026 at 05:40 UTC. Google Safe Browsing returned no flag on Jul 3, 2026 at 05:44 UTC. URLScan completed without a malicious verdict (score 0) on Jul 3, 2026 at 08:10 UTC. The 0/91 VirusTotal result therefore records detection disagreement at that collection time, not the absence of the later source findings.

HTTP 502 was recorded on Aug 7, 2026 at 01:20 UTC; content was unavailable. Registration records for the domain list NameSilo, LLC as the registrar and Jul 1, 2026 as the creation date. Registration preceded first observation by 1 day. At collection time, the hostname resolved to 52.222.236.48 on AS16509 (AMAZON-02 - Amazon.com, Inc., US). The associated network metadata labels the endpoint as AS214036 Ultahost, Inc. in Lelystad, NL. The stored server header is AmazonS3. Captured page title: “Private Search Engine - Brave Search”. DOM analysis completed on Jul 3, 2026 at 06:20 UTC; stored DOM score 0/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Jul 29, 2026 at 02:49 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists edge-fallback.local as the certificate issuer with validity through Jun 1, 2036; checked Jul 3, 2026 at 07:00 UTC.

The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings. Taken together, the page content and independent findings support classifying this hostname as Microsoft impersonation and phishing. The stored record does not establish the post-click interaction, and it does not claim a confirmed wallet-draining transaction or credential submission.