sharepoint3883-4388eral-a8qi[.]bolt[.]host

This domain, sharepoint3883-4388eral-a8qi.bolt.host, is identified as a credential theft operation impersonating Microsoft. Analysis indicates the infrastructure was designed to mimic legitimate Microsoft authentication portals, as evidenced by the page title 'Sign in to your account' and the targeted brand impersonation of Microsoft services. The domain exhibits no indicators of cryptocurrency drainer functionality but instead focuses on harvesting user credentials through deceptive login interfaces. Infrastructure analysis reveals the domain was registered on November 14, 2024, through Cloudflare, Inc., and resolves to the IP address 104.26.13.118, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common observation in malicious domains leveraging free certificate authorities. Detection metrics show 27 out of 95 security vendors flagged this domain on VirusTotal, while it appears on one security blocklist. No Google Safe Browsing (GSB) detections were reported at the time of analysis. The domain has since been taken offline, reducing immediate exposure risk. However, residual threats persist due to potential credential reuse by victims and the possibility of infrastructure reactivation under a new domain. Users who interacted with this domain are advised to reset Microsoft account credentials immediately and enable multi-factor authentication. Organizations should monitor for credential-stuffing attempts originating from harvested credentials and update blocklists to include the IP address 104.26.13.118 and associated indicators of compromise.