microsoft-office365[.]cloud

The domain microsoft-office365.cloud is actively used for brand impersonation targeting Microsoft. Registration data shows the domain was created on April 02, 2026 through IONOS SE, and it resolves to the IPv4 address 217.160.0.235, which is geolocated to Germany and hosted by IONOS infrastructure. No SSL certificate is present, and HTTP requests return a 200 status code, indicating an unencrypted web service. The domain is listed on three public blocklists—PhishDestroy, MetaMask, and SEAL—and has been flagged by 13 of 94 security vendors on VirusTotal. Reputation metrics are poor, with a Gridinsoft trust score of 0/100. DNS configuration includes four authoritative name servers (ns1122.ui-dns.biz, ns1079.ui-dns.com, ns1065.ui-dns.de, ns1086.ui-dns.or) and MX records pointing to mx00.ionos.de and mx01.ionos.de. An AlienVault OTX pulse references the domain in one threat‑intel feed, confirming its presence in threat‑sharing communities. While the exact payload or page content has not been publicly disclosed, the combination of brand‑impersonation labeling, blocklist listings, and multiple vendor detections indicates a high‑risk malicious operation. Defenders should block the domain at network and DNS layers, monitor for outbound connections to the associated IP address, and ensure email filters reject any messages originating from its MX hosts. Continuous re‑evaluation is advised as additional intelligence becomes available.