microsofit[.]mktdigital[.]news

Analysis of microsofit.mktdigital.news, observed as offline on 23 July 2026, indicates a short‑lived infrastructure supporting a Microsoft brand impersonation campaign. The domain was registered through NameCheap, Inc. on 26 April 2021 and uses the public DNS resolvers dns1.registrar-servers.com and dns2.registrar-servers.com. A Let’s Encrypt certificate (issued by the E7 intermediate) was observed, confirming the presence of HTTPS support at the time of investigation. The web server identified by passive fingerprinting is Nginx, and the host resolves to the IPv4 address 196.251.92.94, which maps to a network located in the Netherlands. The IP address is currently listed on at least one security blocklist and is flagged by PhishDestroy as a malicious source.

VirusTotal scans have recorded 13 positive detections out of 95 security vendors, reinforcing the malicious classification. The domain is explicitly listed as impersonating Microsoft, though no page title or content details have been disclosed publicly. The limited evidence suggests the site was used to lure victims into credential harvesting or other unauthorized interactions with the Microsoft brand. Uncertainties remain regarding the exact phishing kit, the presence of any credential‑capture forms, and the period of active operation before takedown.

No additional intelligence such as OTX references, Safe Browsing verdicts, or external reputation scores were provided. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP range for related activity, and add the host to internal threat‑intel feeds. Given the existing blocklist entries and the Let’s Encrypt certificate, any future re‑registration of the same name or similar sub‑domains should be treated as high‑risk and denied by email and web gateways. Ongoing observation of the NameCheap registrar for new registrations that mimic the observed pattern is also recommended.