login-faxplus-outlook[.]com

This domain, login-faxplus-outlook.com, is flagged for brand impersonation phishing targeting Microsoft. Analysis indicates the domain was designed to mimic legitimate Microsoft login portals, likely to harvest credentials or distribute malicious payloads under the guise of trusted services. No specific drainer kit signatures were identified, but the domain structure and naming convention align with known phishing campaigns impersonating enterprise authentication pages. Infrastructure analysis reveals the domain was registered on May 15, 2024, through MarkMonitor, Inc., and resolves to the IP address 13.107.246.40, hosted on AS8075 (Microsoft Corporation) in the United States. The SSL certificate is issued by DigiCert Inc (GeoTrust TLS RSA CA G1), which, while legitimate, does not mitigate the malicious intent of the domain. VirusTotal reports 18 out of 95 security vendors flagging this domain as malicious. It appears on two security blocklists, including PhishDestroy and PhishingDB, and is categorized as a brand impersonation threat. The domain's creation date and rapid detection by multiple vendors suggest a coordinated phishing operation. As of the latest assessment, login-faxplus-outlook.com has been taken offline, with the page title displaying 'Domain has been seized.' While the immediate threat is mitigated, residual risk remains due to potential credential exposure from prior interactions. Organizations are advised to monitor for unauthorized access attempts linked to this domain, revoke compromised credentials, and update security blocklists to include this indicator of compromise. Continuous vigilance is recommended, as threat actors may re-establish infrastructure under similar domains or IPs.