doc53usngwd0c85bdrvsharepoint[.]capitolelectrics[.]com

The domain doc53usngwd0c85bdrvsharepoint.capitolelectrics.com has been identified as a generic_phishing threat. This domain does not appear to be affiliated with a specific brand, nor does it contain a drainer kit. The threat analysis suggests that the domain was likely used to mimic a legitimate SharePoint service to deceive users into providing sensitive information.

Analysis indicates that the domain has a VirusTotal score of 17/95, suggesting a moderate level of detection among security vendors. The domain is registered through Wild West Domains, LLC and resolves to the IP address 216.126.225.58, which is located in the United States. The domain was created on May 20, 2026, and appears on one security blocklist, indicating that it has been flagged for malicious activity. Additionally, the domain has an SSL certificate issued by Let's Encrypt, which may have been used to gain user trust by providing a secure connection.

The current status of the domain is offline, which reduces the immediate risk to users. However, the domain remains flagged by security vendors and blocklists, suggesting that it may be reactivated or used in future campaigns. Organizations should ensure that their endpoints are configured to block this domain and related IP addresses. Additionally, users should be reminded to verify the legitimacy of SharePoint links and to report any suspicious activity to their security teams.