2yus7ngwd0c87v-1drvsharepoint[.]deemfirsts[.]com

This domain represents a targeted phishing campaign designed to harvest Microsoft cloud service credentials. The site presents users with a fraudulent login interface labeled 'One more step...', mimicking legitimate Microsoft authentication prompts. Analysis indicates this is a credential theft operation, likely targeting corporate or personal users of cloud storage and productivity services. The page structure and branding elements closely resemble official Microsoft login portals, increasing the likelihood of successful deception. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on September 01, 2025, through Wild West Domains, LLC, and currently resolves to 152.42.236.77, hosted on DigitalOcean infrastructure in Singapore. Security vendor detection stands at 19/95 on VirusTotal, with two additional security blocklists flagging the domain. The SSL certificate, issued to eighteen73 Ltd, does not match Microsoft's legitimate certificate authority chain, further confirming its fraudulent nature. Users who visited this domain should immediately take protective measures. First, reset any credentials entered on the site, particularly Microsoft account passwords and associated cloud service logins. Enable multi-factor authentication on all accounts where possible to prevent unauthorized access. Monitor account activity for suspicious logins or file modifications, as compromised credentials may be used for follow-on attacks. Organizations should consider implementing additional email filtering rules to block similar phishing domains and educate users about recognizing credential harvesting attempts.