balaxipharma[.]gt

This domain, balaxipharma.gt, is flagged for brand impersonation targeting Microsoft. Analysis indicates the infrastructure was designed to mimic Microsoft login portals, specifically presenting a Spanish-language page titled 'Iniciar sesión en tu cuenta Microsoft.' The domain shows no evidence of crypto drainer or malware deployment but focuses on credential theft through fraudulent authentication pages. Infrastructure analysis reveals the domain was registered on February 21, 2026, resolving to IP address 116.206.104.66 (AS394695, India). The SSL certificate is issued by Let's Encrypt (R12), a common choice for malicious actors due to its low-cost automation. VirusTotal reports 22/95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and was previously blocked by at least one threat intelligence feed. No Google Safe Browsing (GSB) detection is noted in the available data. The domain is currently offline, reducing immediate risk to end users. However, residual risk remains due to the potential for infrastructure reuse or re-registration under a different TLD. Response actions should include monitoring for related domains using the same IP or registration patterns (seed: d9e8e9). Organizations are advised to block the domain and IP at the perimeter, alert employees to the Microsoft impersonation tactic, and verify no successful credential submissions occurred prior to takedown.