in-house-sf[.]com

The domain in-house-sf.com has been identified as a brand impersonation threat targeting Microsoft. This domain was used to deceive users by impersonating Microsoft's brand, potentially leading to unauthorized access or data theft. The page title 'Edit' suggests an attempt to mimic a legitimate service where users might input sensitive information. Although the specific kit used for this attack is not identified, the characteristics align with typical phishing schemes designed to harvest login credentials or other personal data.

Technical analysis of in-house-sf.com reveals several critical indicators. The domain is flagged by 21 out of 95 security vendors according to VirusTotal, indicating a significant reputation risk. It was registered through GoDaddy.com, LLC on February 21, 2026, and resolves to the IP address 69.13.61.33 located in the US, under AS54489 CoreSpace, Inc. An SSL certificate issued by Let's Encrypt was in use, which is common for phishing domains seeking to appear legitimate. Despite its current offline status, it remains listed on at least one security blocklist, demonstrating ongoing recognition of its threat potential.

Currently, the domain is offline and has been blocked by PhishDestroy, reducing the immediate risk of further phishing activity. However, the domain's previous activity and the fact that it impersonated a major brand like Microsoft suggest a persistent threat. Organizations and users should remain vigilant, ensuring that any communications seemingly from Microsoft are verified independently. Security teams should update blocklists and maintain awareness of similar domains that may emerge, as threat actors frequently re-register or adapt their tactics to bypass existing defenses. Ongoing monitoring and user education are essential to mitigate risks associated with brand impersonation threats such as this.