microsoft[.]update[.]eutelnet[.]info

The domain microsoft.update.eutelnet.info was identified as a brand impersonation phishing site targeting Microsoft. The threat type is brand impersonation, where the domain attempts to deceive users into believing it is associated with Microsoft, likely to steal credentials or personal information. The domain was registered through eNom, LLC and resolved to IP address 185.102.77.12. The page title observed was 'Koja je moja IP adresa - 100% domaći hosting - Eutelnet hosting', which is unrelated to Microsoft and suggests the domain may have been repurposed or used for multiple scams.

Technical indicators show that the domain has a VirusTotal detection rate of 1 out of 95 security vendors, indicating low but present malicious flagging. The domain is not listed on Google Safe Browsing, but it appears on 1 security blocklist. The SSL certificate was issued by Let's Encrypt (R12), which is commonly used by both legitimate and malicious sites. The domain was registered through eNom, LLC, and the unique seed identifier for this investigation is 3610ab.

The current status of the domain is offline, meaning it has been taken down or is no longer resolving. PhishDestroy recommends that organizations block any attempts to access this domain and monitor for similar variations. Users who may have interacted with the site should change their passwords and enable two-factor authentication on their Microsoft accounts. While the immediate risk is reduced due to the domain being offline, similar domains may appear, so continued vigilance is advised.