peeldsb-rnicrosoft-login[.]work[.]gd

This domain is flagged as a high-risk credential phishing site targeting Microsoft account users. Analysis indicates the domain peeldsb-rnicrosoft-login.work.gd is designed to impersonate Microsoft login portals, tricking users into submitting sensitive authentication details. The threat type is classified as brand impersonation with a focus on credential harvesting, a common tactic in targeted phishing campaigns.

Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain was registered on June 18, 2022, through Key Systems GmbH and resolves to the IP address 185.199.110.153, hosted on AS54113 (Fastly, Inc.) in the US. Security vendors on VirusTotal flagged the domain with 20/95 detections, while it appears on two independent security blocklists. The SSL certificate is issued under PhishDestroy / botadmin.destroy.tools, a known phishing infrastructure provider. Google Safe Browsing and PhishingDB have also marked this domain as malicious, further corroborating its fraudulent nature.

Mitigation against this type of threat requires a multi-layered approach. Organizations should implement domain-based email filtering to block messages containing this domain or its associated IP address. Endpoint protection systems should be configured to detect and prevent access to known phishing domains, particularly those impersonating Microsoft login pages. Security teams are advised to monitor for unusual authentication attempts and enforce multi-factor authentication (MFA) to mitigate the impact of credential theft. Additionally, user awareness training should emphasize the risks of entering credentials on unfamiliar login portals, even if they appear legitimate.