matildasmagnolias[.]blob[.]core[.]windows[.]net

The domain matildasmagnolias.blob.core.windows.net is currently flagged as an active generic phishing infrastructure. DNS resolution points to the IPv4 address 20.150.31.228, which is hosted on Microsoft Azure’s Blob storage platform, as indicated by the “blob.core.windows.net” suffix and the Azure‑managed nameservers ns1‑39.azure-dns.com, ns2‑39.azure-dns.net, ns3‑39.azure-dns.org, and ns4‑39.azure-dns.org. The domain was registered through MarkMonitor Inc. on August 10, 1995, a creation date that predates typical modern phishing campaigns, suggesting the domain may have been repurposed or leased for malicious use.

Threat intelligence shows that the domain is listed on one security blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming its operational status in phishing distribution. VirusTotal analysis reports that 10 of 91 security vendors have flagged the domain, providing independent corroboration of its malicious nature. No public information is available regarding the site’s SSL certificate, HTTP response codes, page title, or any observed malicious payload, leaving those vectors unverified at this time.

Defenders should immediately add the domain and its resolving IP address to outbound and inbound deny lists, enforce DNS filtering against the identified Azure nameservers, and monitor network traffic for connections to 20.150.31.228. Continuous re‑evaluation of the domain’s status in threat feeds is recommended, as additional indicators such as payload signatures or credential‑stealing pages may emerge in future analyses.