docssharepoints[.]highlandsthreads[.]com

This domain, docssharepoints.highlandsthreads.com, is actively flagged as a high-risk phishing site impersonating Microsoft infrastructure. Analysis indicates the domain was registered on October 14, 2025, through Wild West Domains, LLC, and currently resolves to the IP address 209.97.186.249, hosted on AS14061 (DigitalOcean, LLC) in the United Kingdom. The nameservers ns1.bdm.microsoftonline.com and ns2.bdm.microsoftonline.com suggest an attempt to mimic legitimate Microsoft DNS records, though these are not associated with official Microsoft services. The page title 'Security Check' aligns with known tech-support scam patterns, a classification supported by threat intelligence sources. The domain is blocked by two security blocklists, including PhishDestroy and PhishingDB, and holds a trust score of 0/100 from Gridinsoft and 1/100 from Scamadviser. Fifteen out of ninety-five security vendors on VirusTotal have flagged this domain as malicious, though the remaining vendors have not yet issued detections, leaving some uncertainty about its full scope. The SSL certificate, labeled 'Production-WP-yourcarehome,' does not match Microsoft's legitimate certificate infrastructure, further indicating fraudulent activity. Defenders should treat this domain as an active threat targeting users through brand impersonation. The HTTP status code 403 suggests the server may be configured to restrict direct access, potentially limiting automated analysis. However, the domain remains operational and may still serve malicious content to targeted victims. Network-level blocks should be implemented for 209.97.186.249 and the domain itself, while security teams should monitor for any shifts in hosting or DNS records. Given the domain's age and persistent activity, it is unlikely to be abandoned, and further campaigns may emerge from related infrastructure.