w0m8h7u5a9-my-sharepoint[.]empiremagnetlcs[.]com

This domain, w0m8h7u5a9-my-sharepoint.empiremagnetlcs.com, is identified as a generic phishing site, posing a significant risk to users. The domain is designed to mimic a legitimate SharePoint service, potentially tricking users into entering sensitive information such as usernames, passwords, and other credentials. This can lead to unauthorized access to user accounts and data, compromising personal and organizational security.

Analysis indicates that the domain was created on March 31, 2026, and is registered through Wild West Domains, LLC. The domain resolves to the IP address 144.172.116.19, which is located in the United States and is associated with FranTech Solutions. The SSL certificate for the domain is issued by Let's Encrypt, indicating an attempt to appear more trustworthy to potential victims. On VirusTotal, 13 out of 95 security vendors have flagged this domain as malicious, and it appears on one known security blocklist. The domain was taken offline as of the latest assessment, which may indicate that the campaign has been disrupted or that the operators have moved on to a new attack vector.

If users have visited w0m8h7u5a9-my-sharepoint.empiremagnetlcs.com, it is recommended to immediately change any passwords or credentials that may have been entered on the site. Users should also monitor their accounts for any unusual activity and consider enabling multi-factor authentication for additional security. It is advisable to report the incident to their organization's IT security team and to run a comprehensive security scan on their devices to detect and remove any potential malware.