emailnotifications[.]m365-microsoft[.]com

Analysis of the domain emailnotifications.m365-microsoft.com indicates active phishing infrastructure targeting Microsoft 365 users. The domain was registered on July 12, 2023, through Dynadot Inc and remains operational as of July 23, 2026. Infrastructure analysis reveals the domain uses Azure DNS nameservers (ns1-36.azure-dns.com, ns2-36.azure-dns.net), a configuration that may lend superficial legitimacy but is frequently exploited for phishing campaigns. It currently resolves to the IP address 20.50.64.14, which is associated with Microsoft Azure cloud services, though this does not confirm benign intent.

Security vendor scans show no current detections from the 95 engines that have previously assessed the domain, though the absence of detections does not rule out malicious activity. The domain appears on at least one security blocklist, suggesting prior identification as a potential threat. No additional context is available regarding the specific phishing kit, targeted brand impersonation beyond the domain name, or exact content hosted on the site, as the page has not been directly analyzed. Defenders should note that the domain structure closely resembles legitimate Microsoft 365 notification domains, increasing the likelihood of successful social engineering.

Organizations are advised to block the domain at the DNS or proxy level and monitor for connections to 20.50.64.14. If internal logs show user interactions with this domain, initiate phishing response procedures, including credential resets and endpoint scans. Given the domain's age and continued activity, further investigation into its hosting patterns and associated campaigns is warranted.