no-reply[.]micorsoft-365[.]com

This domain, no-reply.micorsoft-365.com, is actively engaged in a credential harvesting operation targeting users of Microsoft 365 services. Analysis indicates the site mimics legitimate Microsoft 365 login portals, presenting users with fraudulent authentication interfaces designed to capture usernames, passwords, and potentially multi-factor authentication codes. The domain employs social engineering tactics, such as urgent notifications or account verification requests, to coerce victims into entering sensitive credentials. Once obtained, these credentials are likely exploited for unauthorized access to corporate or personal accounts, leading to data breaches, financial fraud, or further phishing campaigns within compromised networks. Infrastructure analysis reveals multiple high-risk indicators associated with this domain. The domain resolves to the IP address 54.174.73.204 and is secured with a Let's Encrypt SSL certificate, a common tactic to lend an appearance of legitimacy. It was registered through NAMECHEAP INC on April 03, 2020, and remains active despite being flagged by 9 out of 95 security vendors on VirusTotal. The domain's age and persistence suggest it is part of a long-standing phishing campaign, potentially operated by threat actors with established infrastructure. Additionally, the misspelling of 'Microsoft' in the subdomain ('micorsoft') is a deliberate attempt to evade detection while remaining visually convincing to unsuspecting users. Users who have interacted with this domain should take immediate corrective action to mitigate potential compromise. First, reset passwords for any accounts accessed through the fraudulent portal, prioritizing accounts with administrative or financial privileges. Enable multi-factor authentication if not already active, using app-based or hardware tokens rather than SMS-based methods. Monitor accounts for unauthorized activity, such as unusual login attempts or changes to security settings. Organizations should review logs for signs of lateral movement or data exfiltration originating from compromised credentials. If corporate credentials were entered, notify internal security teams to initiate an incident response protocol. Finally, report the domain to relevant blocklist providers and security communities to aid in broader threat mitigation efforts.