Indicator of Compromise
passkeyms[.]com
A domain observed in malicious infrastructure. Block or monitor it in DNS and web proxies. Shown defanged for safe viewing; use Copy live value for the functional form.
Included in the Domains feed (live, machine-readable).
Related indicators
Indicators that appear alongside this one in the same reporting, often shared infrastructure or the same campaign.
setupsso[.]com 0811A9866E[.]com107[.]128[.]45[.]122179[.]43[.]185[.]226 185[.]178[.]208[.]153 193[.]34[.]212[.]132195[.]140[.]213[.]114195[.]140[.]213[.]11523[.]234[.]75[.]8431[.]7[.]56[.]5231[.]7[.]56[.]6138[.]42[.]59[.]17147[.]218[.]103[.]14676[.]103[.]148[.]180activatemypasskey[.]comactivatepasskey[.]comactivatepasskeyportal[.]comadd-passkey[.]comaddmypasskey[.]comaddoktapasskey[.]comaddpasskey2fa[.]comaddssopasskey[.]comaddyourpasskey[.]comassignpasskey[.]comcheckpasskey[.]comcompany[.]sharepoint[.]comcreatemfa[.]comcreatemypasskey[.]comcreatepasskey[.]comcreatessopasskey[.]com deploypasskey[.]com enablepasskey[.]comenablepasskey2fa[.]comenrollms[.]comenrollpasskey[.]comgetsession[.]orghxxps://company[.]sharepoint[.]com/sites/ProductionOps/hxxps://organization[.]sharepoint[.]com/sites/Legal_Archive/hubpasskey[.]comidokta[.]com