microslopft[.]com

The domain microslopft.com was registered on April 02, 2026 through InterNetX GmbH and is currently active. It is being used to impersonate Microsoft, presenting a page titled “Microslopft | Productivity, But Worse” in an attempt to lure victims into credential harvesting. The threat is classified as a Microsoft brand impersonation campaign with a high risk rating. Infrastructure analysis shows the domain resolves to IP address 217.160.0.60, hosted by Ionos Inf in Germany. The site serves content over HTTPS using a Let’s Encrypt R12 certificate, indicating a recent acquisition of a valid TLS certificate. Authoritative name servers are docks11.rzone.de and shades12.rzone.de, both belonging to the same hosting environment. The domain appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, and has been referenced in a single AlienVault OTX pulse. VirusTotal scans report that 2 out of 95 security vendors flag the domain as malicious, while the Gridinsoft trust score is 0 out of 100, reinforcing its malicious classification. HTTP responses return a 200 status code, confirming that the malicious landing page is actively served. Defenders should immediately block resolution of microslopft.com at the DNS layer and add the associated IP address 217.160.0.60 to network‑level deny lists. Continuous monitoring of the rzone.de name server range is advised, as the same infrastructure may be reused for additional impersonation campaigns. End‑user awareness training should highlight the misspelled brand name and the unusual page title to reduce the likelihood of credential submission. Incident response teams should collect any observed traffic for forensic analysis and consider sinkholing the domain if legally permissible.