mscsharepoint-pearl[.]vercel[.]app

PhishDestroy identifies mscsharepoint-pearl.vercel.app as a confirmed generic phishing site designed to deceive users into revealing login credentials. The domain mimics a SharePoint login page, leveraging the trusted brand to harvest sensitive information. Analysis reveals no specific drainer kit was detected, but the site's structure is consistent with credential theft.

Technical indicators paint a clear picture of malicious intent. VirusTotal reports 15 out of 95 security vendors flagging this domain, a strong signal of widespread recognition as a threat. The domain was registered through Tucows Domains Inc. and created on February 21, 2026, indicating recent deployment. It resolves to IP address 64.29.17.67 and uses an SSL certificate from Google Trust Services (WR1). The page title displayed was 'Deployment Unavailable', suggesting the site may have been taken down or is currently non-functional. The domain appears on 2 security blocklists and is not listed on Google Safe Browsing (GSB), meaning some protections may not have caught it yet.

As of this assessment, the domain is offline, likely due to takedown actions by hosting providers or registrars following reports. However, the risk remains elevated as similar phishing campaigns may reappear under different domains. Users should exercise caution with any unsolicited login prompts, especially those claiming to be SharePoint. PhishDestroy recommends verifying the legitimacy of such sites through official channels and avoiding entering credentials on unknown domains.