steelheadincs[.]com

steelheadincs.com was registered through Wild West Domains, LLC on September 03, 2025 and delegated to the Microsoft‑related nameservers ns1.bdm.microsoftonline.com, ns2.bdm.microsoftonline.com and ns3.bdm.microsoftonline. The domain resolves to IP 172.236.28.169, which is announced by AS63949 Akamai Connected Cloud and geolocated to Great Britain. No TLS certificate was observed, indicating that the site was served over plain HTTP. The landing page returns the title "Checking your browser before accessing", a phrase commonly used in redirection or verification stages of phishing flows. The infrastructure is associated with a tech‑support‑scam campaign that impersonates Microsoft, as indicated by the brand target field.

VirusTotal analysis recorded 18 detections out of 95 scanned vendors, and the domain has been listed on a single security blocklist. Threat intelligence aggregators have cited the domain in fourteen Open Threat Exchange pulses, and PhishDestroy has confirmed that the site is blocked. The domain was taken offline prior to the report date of July 23, 2026, and is currently marked as offline in monitoring systems. The available evidence confirms that steelheadincs.com was used as a brand‑impersonation vector targeting Microsoft users via a tech‑support narrative.

However, the specific payload, credential‑stealing mechanisms, and user‑interaction flow have not been publicly disclosed, leaving the exact attack vector uncertain. Defenders should continue to block the domain and its hosting IP at perimeter firewalls and DNS filtering points, monitor for any re‑registration attempts, and add the observed nameserver pattern to heuristic detection rules. Incident response teams should also correlate any alerts referencing the "Checking your browser before accessing" title with known Microsoft tech‑support scams to reduce false positives and to identify potential victims.