noawin[.]com

PhishDestroy identifies noawin.com as a recently activated domain engaging in credential-harvesting operations disguised as a Microsoft 365 login portal. The infrastructure exhibits hallmarks of a generic phishing campaign, including a newly registered domain, rapid SSL provisioning, and hosting on a bulletproof IP space associated with prior malicious activity. While no specific brand impersonation was confirmed in the initial analysis, the domain’s recent creation and low detection profile suggest it is part of a fast-moving campaign targeting enterprise users under the guise of a legitimate Microsoft authentication flow. The drainer kit appears to be a basic HTML-based credential collector with client-side validation, likely distributed via spear-phishing emails leveraging urgency or executive impersonation tactics. This domain was flagged by 3 out of 95 security vendors on VirusTotal, indicating a low initial detection rate that may allow the campaign to slip past perimeter defenses. The domain was registered on April 12, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar known to offer privacy protection services that can obscure true ownership and hinder takedown efforts. It resolves to IP address 188.114.97.3, a segment historically linked to bulletproof hosting providers and previously flagged in relation to malware distribution and C2 infrastructure. The domain is protected by a Let's Encrypt SSL certificate, which adds legitimacy to phishing pages and may enable bypass of browser-based security controls. Google Safe Browsing (GSB) has not yet blacklisted this domain, and it remains absent from major threat intelligence feeds beyond the limited VT detection. With only four confirmed detections across public sandboxes and security platforms, noawin.com represents a high-evasion threat with elevated risk to organizations lacking advanced email and web filtering. As of this advisory, noawin.com remains active and unblocked across most threat intelligence platforms, including GSB. Immediate response actions include adding the domain and resolving IP to organizational blacklists, inspecting DNS resolution logs for internal queries, and scanning email gateways for messages referencing Microsoft 365 login pages. Given the domain’s recent registration (within 7 days), proactive hunting for Indicators of Compromise (IoCs) such as the SSL thumbprint, page hash, or email sender domains is strongly recommended. While the current risk is elevated due to low detection coverage, rapid response and containment could mitigate successful credential theft. Users should be warned not to enter credentials on any unexpected Microsoft login prompts and to verify URLs via official channels.