login-microsft365secure-auth[.]fr

The domain login-microsft365secure-auth.fr was registered through GANDI on July 27, 2026 and is currently active. Its authoritative nameservers—ns-210-a.gandi.net, ns-6-b.gandi.net, and ns-84-c.gandi.net—are consistent with the registrar’s default configuration, indicating no attempt to hide hosting details. DNS resolution points to the single IPv4 address 217.70.184.38, a host that appears on three external security blocklists.

The domain has been flagged by multiple threat‑intelligence feeds, including PhishDestroy, MetaMask, and SEAL, reinforcing the likelihood of malicious intent. VirusTotal analysis shows that one of ninety‑one scanned security vendors flagged the domain, providing an additional independent detection signal. The rapid creation‑to‑detection timeline—registered only one day before the July 28, 2026 report—matches patterns observed in credential‑phishing campaigns that leverage freshly‑minted domains to evade reputation‑based defenses.

While the specific content hosted on the site has not been disclosed, the convergence of registrar data, DNS infrastructure, blocklist presence, and vendor detections collectively point to a high‑risk credential‑phishing operation. Defenders should immediately block traffic to login-microsft365auth.fr and its resolved IP address, incorporate the domain into URL filtering policies, and monitor for related indicators such as the listed nameservers or the IP 217.70.184.38. Ongoing surveillance is recommended to capture any future payloads or associated infrastructure that may emerge as the campaign evolves.