3658e101[.]cc

Analysis of the domain 3658e101.cc indicates active phishing infrastructure targeting Microsoft 365 credentials. The domain was registered on May 3, 2026, through Dynadot Inc and currently resolves to the IP address 40.81.18.27, which is associated with hosting services. As of July 21, 2026, the domain remains active and is flagged by 13 of 95 security vendors on VirusTotal, suggesting detection by multiple threat intelligence sources. It is also listed on the PhishDestroy blocklist, reinforcing its classification as malicious. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious domains due to its free and automated issuance process. The nameservers, ns1.1233dns.com and ns2.951dns.com, are consistent with infrastructure observed in other phishing campaigns, though their exact relationship to threat actors remains unconfirmed. No specific phishing kit or brand impersonation details are available in the current evidence, but the domain name and targeting pattern align with Microsoft 365 credential theft attempts. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access to it. Network-level protections, such as DNS filtering or IP-based restrictions, are recommended to prevent user exposure. Further investigation into the hosting provider and nameserver infrastructure may reveal additional linked domains or campaign patterns. The domain's continued activity and detection by multiple security vendors indicate it is part of an ongoing phishing operation.