microsotfs[.]com

This domain, microsotfs.com, was registered on July 31, 2026, through HOSTINGER operations, UAB, and is currently active. Infrastructure analysis reveals it resolves to the IP address 84.32.84.73, with nameservers configured as lunar.dns-parking.com and solar.dns-parking.com, a pattern commonly associated with low-cost or disposable hosting setups. At the time of assessment, four out of ninety-one security vendors on VirusTotal have flagged the domain as malicious, and it appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. The domain name itself closely resembles Microsoft branding, suggesting a likely phishing attempt targeting users of Microsoft services, though the exact content or targeted service (e.g., login portals, account verification, or software downloads) has not been confirmed through direct analysis.

Defenders should treat this domain as high-risk based on the combination of recent registration, low-reputation hosting infrastructure, and active blocklist presence. The use of DNS parking nameservers may indicate an attempt to evade detection or quickly reassign infrastructure. While the domain remains active, no additional context—such as SSL certificate details, HTTP response codes, or specific phishing kit signatures—has been provided.

Organizations are advised to block traffic to and from 84.32.84.73 and microsotfs.com at the network perimeter, monitor for internal connections to this domain, and review logs for any prior interactions. If endpoint or proxy logs reveal user visits, initiate incident response procedures to assess potential credential exposure or malware delivery. Given the domain’s age and active status, further monitoring for changes in hosting or detection rates is recommended.