auth2usngwd0c88bdrvsharepoint[.]wardhealthpa[.]com

The domain auth2usngwd0c88bdrvsharepoint.wardhealthpa.com is currently active and confirmed as a fraudulent SharePoint login portal designed to harvest credentials. Analysis indicates this is a targeted brand impersonation attack, mimicking legitimate Microsoft SharePoint authentication pages to deceive users into submitting corporate or personal login details. The site remains operational, displaying a generic 'Processing...' page title, which is commonly used to mask malicious intent while backend scripts capture submitted data. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on June 03, 2026, through Wild West Domains, LLC, a registrar frequently associated with newly created phishing domains. It resolves to the IP address 172.86.91.9 and is flagged by 21 of 95 security vendors on VirusTotal, including detection as a generic phishing threat. Additionally, the domain appears on one security blocklist and is actively blocked by enterprise phishing detection systems. The SSL certificate is issued by Let's Encrypt (YE1), a common choice for threat actors due to its low-cost and automated issuance process. Current status confirms the domain remains active and operational. Organizations and users are advised to block the domain and its associated IP at the network perimeter. Security teams should review logs for connections to 172.86.91.9 and monitor for credential submission attempts originating from internal networks. If user interaction is suspected, immediate password resets and multi-factor authentication enforcement are recommended. Proactive measures include updating endpoint protection rules to detect and prevent access to newly registered domains with similar naming patterns.