excelformula[.]in

This domain, excelformula.in, is flagged as a high-risk phishing site targeting Microsoft 365 credentials. Registered on September 6, 2023, through GoDaddy, it remains active as of July 18, 2026. Infrastructure analysis reveals the domain resolves to IP 103.191.208.92 and uses nameservers ns37.domaincontrol.com and ns38.domaincontrol.com. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for both legitimate and malicious sites. Threat intelligence indicates the domain appears in five AlienVault OTX pulses, suggesting repeated malicious activity. VirusTotal reports 10 of 91 security vendors flagging the domain, though the specific detection rules or payloads are not detailed in available data. The domain's name, excelformula.in, implies a focus on Excel or Microsoft 365-related phishing, likely leveraging themes such as spreadsheet formulas, document sharing, or productivity software to deceive users. No specific brand impersonation or phishing kit details are confirmed, but the naming convention aligns with credential harvesting tactics. Defenders should treat this domain as hostile and prioritize blocking it at DNS, proxy, and endpoint layers. Network logs should be reviewed for connections to 103.191.208.92 or the domain itself, particularly from users who may have interacted with Microsoft 365-related content. If internal phishing simulations or training materials reference Excel or formula-related lures, this domain may serve as a real-world example for awareness. Further analysis of the site's content is recommended to confirm the exact phishing kit or payload, though defenders should assume credential theft intent based on current intelligence.