2yusq7ngwdm363cj87v96gs5do-workspacesharepoint[.]hbccontsr[.]com

Analysis of the domain 2yusq7ngwdm363cj87v96gs5do-workspacesharepoint.hbccontsr.com indicates a Microsoft brand impersonation campaign that leverages a tech‑support narrative. The domain was registered on 27 April 2025 through Wild West Domains, LLC and uses the public‑suffix hbccontsr.com. Its authoritative nameservers are ns1.bdm.microsoftonline.com and ns2.bdm.microsoftonline.com, which are legitimate Microsoft Online DNS hosts, a tactic often used to increase perceived authenticity. The site resolves to the IP address 142.93.45.141, which belongs to AS14061 DigitalOcean, LLC and is geolocated in Great Britain. No TLS certificate was presented, and the HTTP response is currently offline, matching the "taken offline" status reported by the blocklist.

The only visible page title returned before takedown was "Verifying your connection…", a generic phrase commonly employed in tech‑support scams to suggest a diagnostic process. Reputation services have assigned a Scamadviser trust score of 1 / 100, indicating extreme distrust. The domain appears on a single security blocklist, specifically PhishDestroy, and VirusTotal recorded detections from 15 of 95 scanning engines, confirming malicious classification by multiple vendors. The elevated risk rating aligns with the identified scam type, "Tech Support Scam", and the explicit brand target "Microsoft".

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no SSL certificate or active page content is available for analysis. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP range, and add the domain and its IP to internal deny lists. Threat‑intel teams should also watch for newly‑registered sibling domains using the same registrar or nameserver pattern, as the use of Microsoft‑owned nameservers suggests a reusable template.