project-docfile[.]top

Analysis of project-docfile.top indicates that the domain was registered on October 6 2025 through NameSilo, LLC and is currently taken offline. The site presented a page titled “Microsoft‑Sicherheitsüberprüfung”, which aligns with a Microsoft‑impersonation tech‑support scam. The infrastructure resolves to IP 173.44.141.64, an address owned by AS62904 (Eonix Corporation) in the United States. The domain uses the dnsowl.com nameserver set (ns1, ns2, ns3).

No TLS certificate was observed, meaning the site was delivered over HTTP only. Reputation checks show a Gridinsoft trust score of 0 / 100 and a block entry from PhishDestroy; the domain also appears on a single security blocklist. AlienVault OTX lists the domain in fifteen separate threat‑intel pulses, and VirusTotal recorded 14 of 95 scanners flagging it as malicious. The combination of brand‑targeted page title, low trust score, multiple blocklist references, and detection by several anti‑malware engines confirms the activity as a Microsoft‑impersonation tech‑support scam.

Uncertainty remains regarding the exact content delivered at the URL, as the site is offline and no snapshot is available; however, the observed indicators are sufficient to classify the domain as a high‑confidence malicious actor. Defenders should ensure that any outbound connections to 173.44.141.64 are blocked, update URL filtering rules to include project-docfile.top, and monitor for additional domains hosted on the same nameserver set or IP range. Continuous ingestion of OTX pulses and VirusTotal feeds is recommended to capture potential re‑use of the infrastructure.