thesharepointworks[.]com

The domain thesharepointworks.com was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently active. DNS resolution points to IP address 188.114.96.3, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. The site is fronted by Cloudflare services, includes HTTP/3 support, and presents an HTTP 530 response code. The TLS certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS endpoint despite the underlying malicious intent.

The page title returned by the server is "thesharepointworks.com | 523: Origin is unreachable," providing no further insight into the content served. The domain is listed on a single security blocklist and has been flagged by PhishDestroy. VirusTotal analysis shows that 1 of 93 scanned security vendors flagged the domain, confirming at least one detection. Nameserver configuration uses corey.ns.cloudflare.com and kelly.ns.cloudflare.com, consistent with the Cloudflare hosting profile.

The threat actor is explicitly targeting Microsoft by impersonating the brand, as indicated in the intelligence feed. While the exact page content has not been captured, the combination of brand impersonation, active Cloudflare infrastructure, a valid Google‑issued certificate, and a non‑standard HTTP 530 status suggests a deliberate attempt to lure Microsoft users to a deceptive endpoint. Defenders should add thesharepointworks.com to outbound web‑filter deny lists, block its resolved IP 188.114.96.3 at the network perimeter, and monitor for any DNS queries to the associated nameservers. Continuous observation of the domain’s certificate and HTTP response changes is advised, and security products should be updated with the provided indicators of compromise to improve detection across the environment.