2yusq7ngwdm363cj87v96gs5do-docusignsharepoints[.]steelheadincs[.]com

On July 23, 2026 analysts observed that the sub‑domain 2yusq7ngwdm363cj87v96gs5do-docusignsharepoints.steelheadincs.com was taken offline but retained a history of malicious activity targeting Microsoft users. The domain was registered on September 03, 2025 through Wild West Domains, LLC and uses Microsoft‑styled nameservers (ns1.bdm.microsoftonline.com, ns2.bdm.microsoftonline.com), a technique often employed to lend credibility to phishing infrastructure. DNS resolution points to IP address 166.88.54.28, which belongs to AS149440 (Evoxt Sdn. Bhd.) and is geolocated in Great Britain.

No TLS certificate was observed, meaning the site operated over HTTP only, a common trait of low‑effort tech‑support scams. The page title returned by the server was "Checking your browser before accessing," providing no functional content but indicating a placeholder often used to delay analysis. The site explicitly impersonated Microsoft, aligning with the reported scam type of a tech‑support fraud. Security‑vendor intelligence shows that 18 of 95 VirusTotal scanners flagged the domain, and it appears on a single blocklist, PhishDestroy, confirming that at least one reputable feed recognized it as malicious.

Scamadviser assigned a trust score of 1 out of 100, reinforcing the high probability of abuse. Although the infrastructure is currently offline, defenders should continue to monitor the associated IP range (166.88.54.28/AS149440) for re‑use, enforce strict outbound filtering for traffic to Microsoft‑related endpoints, and ensure that endpoint protection solutions flag any attempts to resolve this domain. Blocking the domain and its IP at the network perimeter, alongside updating URL filtering lists with the observed host, will mitigate residual risk. Further investigation is needed to determine whether additional sub‑domains under the steelheadincs.com zone share the same naming convention or hosting configuration, which could indicate a broader campaign infrastructure.