inrs[.]rricrosoft-office[.]org

The domain inrs.rricrosoft-office.org has been confirmed as an active phishing site impersonating Microsoft Office, with an elevated threat level currently in operation.

PhishDestroy identifies the domain inrs.rricrosoft-office.org as a confirmed Microsoft Office credential phishing site, currently active and elevated in risk. This domain was flagged by 12 of 95 VirusTotal security vendors, registered through Dynadot Inc on July 07, 2023, and resolves to IP address 20.50.64.14. The domain utilizes a Let's Encrypt SSL certificate to appear legitimate and has accumulated a concerning detection footprint, reflecting its malicious intent.

Risk assessment for inrs.rricrosoft-office.org remains elevated due to sustained phishing operations targeting Microsoft Office users. To mitigate exposure, users must avoid interacting with this domain and report it through official Microsoft or PhishDestroy channels. Network administrators should implement DNS-based blocking using the IP address 20.50.64.14 and domain name inrs.rricrosoft-office.org. Additionally, updating endpoint protection systems with the latest threat intelligence derived from this report will help prevent credential theft and lateral network compromise.