gmpvkb[.]shop

The domain gmpvkb.shop has been identified as a phishing infrastructure specifically designed to impersonate Microsoft login portals. Analysis confirms this domain as a credential harvesting platform, currently offline but previously active in distributing fraudulent authentication pages. The threat type is classified as a targeted phishing campaign against corporate and personal Microsoft account holders. Infrastructure analysis reveals the domain was registered through GNAME.COM PTE. LTD. on June 19, 2026, and resolved to the IP address 185.255.198.196. Security vendors on VirusTotal flagged this domain, with 8 of 95 engines detecting malicious activity. The domain appears on four security blocklists, including PhishDestroy, PhishingArmy, OISD, and Hagezi. The SSL certificate was issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. At present, gmpvkb.shop has been taken offline, though historical DNS records and threat intelligence indicate prior malicious activity. Organizations and individuals are advised to block the domain and associated IP at the network perimeter. Security teams should review logs for connections to 185.255.198.196 or the domain name, particularly from endpoints that may have interacted with Microsoft-themed login prompts. Credential reset procedures are recommended for any accounts potentially exposed to this infrastructure.