portalvalide[.]wuaze[.]com

This domain, portalvalide.wuaze.com, is actively flagged as a high-risk phishing site impersonating Microsoft, as indicated by its page title 'Inicie sesión en su cuenta de Microsoft.' Infrastructure analysis reveals the domain was registered on August 16, 2023, through NameCheap, Inc., and is hosted on IP address 185.27.134.133, associated with AS34119 (Wildcard UK Limited) in Great Britain. The domain resolves to nameservers ns1.byet.org through ns5.byet.org, a hosting pattern commonly observed in phishing campaigns. Its MX record points to mx.wuaze.com with a priority of 5, suggesting potential email-based attack vectors. Security vendor assessments reinforce its malicious classification: Gridinsoft assigns a trust score of 0/100, and PhishDestroy has blocked the domain.

Fifteen of 95 security vendors on VirusTotal have flagged this domain as malicious, though this detection rate should not be interpreted as exhaustive. The domain appears on at least one security blocklist, and its SSL certificate is issued by ZeroSSL, a common choice for both legitimate and fraudulent sites, providing no inherent indication of trustworthiness. The HTTP status code 200 confirms the site is currently accessible, and the domain remains active as of the report date.

While the exact content and functionality of the site have not been analyzed, the combination of its Microsoft-branded page title, low trust scores, and security vendor detections strongly suggests it is being used for credential harvesting or tech support scams. Defenders should treat this domain as malicious, block it at the network level, and monitor associated infrastructure, including the IP 185.27.134.133 and nameservers, for further phishing activity. No evidence currently links this domain to broader campaign infrastructure, but its registration age and hosting choices warrant continued scrutiny.