ms365-device[.]com

Analysis of ms365-device.com indicates that the domain is actively being used for a generic phishing campaign as of the report date, August 04, 2026. The domain was registered on July 23, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com, suggesting a recent creation that aligns with typical phishing infrastructure turnover. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, providing the first layer of defensive action against its traffic.

VirusTotal scans show that 23 of 91 security vendors have flagged the domain as malicious, reinforcing the suspicion of malicious intent despite the majority of scanners not yet issuing a detection. No additional public intelligence sources such as Open Threat Exchange (OTX) or Google Safe Browsing reports are currently listed for this domain, and no evidence of SSL certificates, HTTP response codes, hosting ASN, or geographic location has been disclosed. The page title and any observable content have not been captured, leaving the exact lure or credential‑stealing mechanism unknown.

Given the limited but consistent indicators—recent registration, blocklist presence, PhishDestroy block, and a multi‑vendor detection count—defenders should treat ms365-device.com as a high‑confidence phishing indicator. Recommended actions include adding the domain to internal blocklists, monitoring DNS queries for lookups, and correlating any authentication attempts originating from this host with user activity logs. Continuous re‑evaluation is advised as further telemetry becomes available, particularly regarding hosting details, SSL usage, and any observed payloads associated with the domain.