365etop2[.]com

Analysis of 365etop2.com indicates an active credential phishing campaign targeting Microsoft users. The domain was registered on February 27, 2024 through DYNADOT LLC and resolves to IP address 14.128.54.125, which is located in Japan and belongs to AS396982 (Google LLC). DNS resolution is provided by clayton.ns.cloudflare.com and fatima.ns.cloudflare.com. The site serves content over HTTPS using a ZeroSSL ECC DV SSL certificate issued by ZeroSSL GmbH, and the web server is identified as Nginx responding with HTTP 200. The page title "365专用通道" aligns with the reported brand impersonation of Microsoft. Security telemetry shows the domain is blocked by PhishDestroy, appears on one external blocklist, and received a Gridinsoft trust score of 0/100. VirusTotal analysis recorded 8 detections out of 91 scanned engines, reinforcing the high‑risk classification. While the observed infrastructure confirms the phishing infrastructure, the actual page content beyond the title has not been publicly disclosed, leaving the exact credential capture mechanisms uncertain. Defenders should immediately block the domain and its associated IP, include it in internal URL filtering policies, and monitor for related activity from the same nameservers or registrar. Continuous re‑evaluation of detection signatures is advised given the evolving nature of the campaign.