update365bonline[.]online

PhishDestroy identifies update365bonline.online as an active credential phishing domain designed to mimic Microsoft services. This domain employs a classic drainer kit strategy, luring users into entering their login credentials under the guise of a fake 'update365bonline' portal. The threat actor leverages social engineering by mimicking a legitimate Microsoft-branded update page, likely distributed through phishing emails or malicious ads. The domain's infrastructure suggests a hasty setup, with minimal detection coverage and a focus on exploiting user trust in well-known software brands.

This domain was flagged by VirusTotal with a detection score of 1 out of 95 security vendors, indicating extremely low visibility among scanning tools. It was registered through HOSTINGER operations, UAB, on March 27, 2024, and resolves to the IP address 145.79.213.135. The domain utilizes a Let's Encrypt SSL certificate, which may lend an air of legitimacy to unsuspecting users. As of the latest assessment, the domain remains active, with no known inclusion in Google Safe Browsing (GSB) blocklists. The low detection rate and recent registration date suggest this is a newly deployed threat with potential for widespread abuse if left unchecked.

The current status of update365bonline.online is active, with no immediate takedown or blocklisting observed. Users are strongly advised to avoid interacting with this domain or any associated links, as it poses an elevated risk of credential theft. To mitigate exposure, security teams should consider blocking the domain at the network level and updating endpoint protection rules to flag this IP (145.79.213.135) and domain. The remaining risk is elevated due to the domain's low detection rate and the likelihood of further campaigns leveraging similar infrastructure. Proactive monitoring and user education on recognizing credential phishing attempts are critical to reducing the threat posed by this domain.