docupdate[.]foundation

This domain, docupdate.foundation, is actively engaged in credential phishing targeting enterprise users through a fake Microsoft login portal. The site mimics official Microsoft authentication pages to harvest corporate credentials, with a focus on Outlook and Office 365 logins. As of the latest analysis, the domain remains operational and has not yet been widely detected by security vendors. Infrastructure analysis reveals the domain was registered on June 30, 2026, through NAMECHEAP INC, a registrar frequently associated with malicious domains. It resolves to the IP address 192.64.119.168, which has no prior history of hosting legitimate services. VirusTotal reports 0 detections out of 95 security vendors, indicating low initial visibility. AlienVault OTX lists the domain in one threat intelligence pulse, suggesting early-stage detection by at least one security community. The domain's creation date is unusually recent, and its lack of prior legitimate use further supports its classification as malicious infrastructure. The current risk level remains under investigation, but the domain's active status and targeted phishing tactics warrant immediate mitigation. Organizations are advised to block the domain and its resolving IP at the network perimeter. Endpoint protection should be updated to flag any connections to docupdate.foundation or 192.64.119.168. Users who may have interacted with the site should reset their credentials via official Microsoft portals and enable multi-factor authentication. Security teams should monitor for any lateral movement or unauthorized access originating from credentials potentially compromised through this phishing campaign.