microsoft-office356[.]com

Analysis of microsoft-office356.com indicates an active brand‑impersonation campaign targeting Microsoft. The domain was registered on 2026‑04‑02 through Global Domain Group LLC and resolves to 91.185.212.27, an address associated with a broadband provider in Slovenia. DNS resolution uses nameservers ns7.webicom.si and ns8.webicom.si, and the MX record points to the domain itself. The site serves HTTP 200 responses and presents the page title “Microsoft 365 Copilot — Work smarter across Microsoft 365”. An SSL certificate issued by Let’s Encrypt (R13) is present, confirming TLS support. Reputation metrics show a Gridinsoft trust score of 0/100 and detection by 2 of 94 vendors on VirusTotal. The domain appears in eight AlienVault OTX pulses and is listed on three public blocklists, with confirmed blocking by PhishDestroy, MetaMask, and SEAL. Current status remains active. Uncertainty remains regarding the exact content delivered to victims, as no visual or form analysis is available. Defenders should prioritize sink‑holing or firewall denial of traffic to 91.185.212.27 and enforce DNS filtering for the domain and its authoritative nameservers. Continuous monitoring of the associated IP and related threat‑intel feeds is advised to capture any escalation.