microsoftweb365[.]fwh[.]is

This domain microsoftweb365.fwh.is is assessed as a high-confidence brand impersonation asset targeting Microsoft authentication flows. The naming structure suggests credential harvesting attempts by mimicking Microsoft 365 login portals. Infrastructure indicators show deployment on shared hosting typically associated with low-cost rapid provisioning, consistent with disposable phishing infrastructure. Current status indicates it has been taken offline, reducing active exposure but not eliminating historical compromise risk.

Technical evidence includes resolution to IP 185.27.134.225 and registration via FreeWebHostingArea. The domain was created June 12 2026, indicating a very recent lifecycle consistent with short-lived phishing campaigns. Security telemetry shows 21/95 VirusTotal detection ratio and presence on 3 independent security blocklists, including Phishunt, PhishDestroy, and PhishingArmy. SSL issuance by ZeroSSL GmbH is noted, while external reputation scoring from Gridinsoft assigns a trust score of 0/100, indicating maximum risk classification.

If users interacted with or submitted credentials to this domain, immediate remediation is recommended. Passwords associated with Microsoft accounts should be changed without delay, and multi-factor authentication should be reviewed for unauthorized changes. Systems should be scanned for session token theft or persistence mechanisms, especially browser-stored credentials. Any reuse of passwords across services should be considered compromised. Network defenders should block IP 185.27.134.225 and related indicators, and monitor logs for attempted authentication against Microsoft services originating from this infrastructure.