365infverificar[.]fwh[.]is

This domain, 365infverificar.fwh.is, is currently active and classified as a generic phishing threat specializing in fake Microsoft 365 login portals. Analysis indicates the infrastructure is designed to harvest user credentials by mimicking legitimate authentication pages, a tactic commonly associated with credential theft and subsequent account compromise. The domain does not explicitly replicate a single brand but leverages the widely recognized Microsoft 365 identity to deceive targets into entering sensitive information. Infrastructure analysis reveals multiple high-risk indicators. The domain resolves to the IP address 185.27.134.59 and was registered on November 01, 2024, through FreeWebHostingArea, a registrar frequently associated with low-cost or free hosting environments. It is flagged by 16 of 95 security vendors on VirusTotal, with one confirmed appearance on a security blocklist. The SSL certificate is issued by ZeroSSL GmbH, a provider commonly used for both legitimate and malicious domains, offering no inherent trust signal. The combination of recent registration, low-cost hosting, and detection by multiple security engines strongly suggests malicious intent. The domain remains active and poses an elevated risk to users. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Endpoint protection solutions should be updated to include this domain in phishing and credential theft detection rules. Users who may have interacted with this domain should immediately reset their Microsoft 365 credentials from a secure device and enable multi-factor authentication. Security teams are encouraged to monitor for related indicators, including the IP address 185.27.134.59 and any subdomains or redirect chains originating from 365infverificar.fwh.is.