b31m[.]top

This domain is flagged as an active phishing infrastructure designed to harvest Microsoft account credentials through fraudulent login portals. Analysis indicates the site employs Vue.js for dynamic content rendering, Nginx as a reverse proxy, and Cloudflare for traffic obfuscation, creating a convincing but malicious user experience. The domain enforces HSTS and HTTP/3 protocols, further masking its true intent under a veneer of technical legitimacy. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain b31m.top was registered on May 26, 2026, through NameMart Pte. Ltd., a registrar frequently associated with recently established phishing operations. It currently resolves to the IP address 103.27.177.164, which has been flagged by 10 out of 95 security vendors on VirusTotal for malicious activity. The SSL certificate, issued by Let's Encrypt, is valid and correctly configured, which is a common tactic to evade browser security warnings and increase victim trust. No legitimate brand association has been identified, confirming its fraudulent purpose. Users who have visited b31m.top or entered credentials on any page hosted under this domain should immediately revoke access to all active sessions and change passwords for their Microsoft accounts and any other services where identical credentials were reused. Enable multi-factor authentication where available to prevent unauthorized access. Organizations are advised to block the domain and its resolving IP at the network perimeter, and monitor for internal connections to 103.27.177.164. Security teams should review logs for user interactions with this infrastructure and initiate incident response procedures if credential exposure is confirmed.