microsinfos[.]com

This report documents the infrastructure and detection profile of microsinfos.com, a domain identified as a generic phishing site. The domain was registered on 2026-03-06 through NameSilo, LLC and is serviced by the namecheaphosting.com name servers dns1.namecheaphosting.com and dns2.namecheaphosting.com. DNS resolution points to the IPv4 address 68.65.123.163, which is hosted in the United States and belongs to autonomous system AS22612 operated by Namecheap, Inc. No TLS certificate is present, indicating that the site was served over plain HTTP. The HTTP response, when captured, returned a page title of “Index of /”, providing no additional context about the intended malicious payload.

The domain appears on three independent blocklists—PhishDestroy, MetaMask, and SEAL—demonstrating that multiple security‑focused feeds have recognized it as malicious. Analysis on VirusTotal shows that two of ninety‑four scanning engines have generated a positive detection, confirming that at least a subset of automated scanners consider the domain suspicious. The site is currently reported as offline, which may be the result of takedown actions or temporary hosting disruption. Uncertainty remains regarding the specific phishing campaign details, such as the targeted brand, lure content, or whether additional infrastructure (e.g., command‑and‑control servers) is linked to the same IP address.

Defenders should continue to block the domain at network perimeter devices, enforce DNS sink‑hole or filtering rules that reference the listed blocklists, and monitor the IP address 68.65.123.163 for potential reuse. Given the absence of an SSL certificate, any future reactivation would likely present the same insecure HTTP endpoint, simplifying detection by transport‑layer inspection. Continuous re‑evaluation of VirusTotal and other reputation services is recommended to capture any changes in detection status.