docs-accoun7-app-id7xu[.]ondigitalocean[.]app

Analysis of docs-accoun7-app-id7xu.ondigitalocean.app indicates a credential phishing infrastructure targeting Microsoft users. The domain resolves to IP address 162.159.140.98, an address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. Hosting is provided through Cloudflare, as evidenced by the authoritative nameservers elias.ns.cloudflare.com and sydney.ns.cloudflare.com. The site was registered on June 01, 2020 through MarkMonitor, Inc., a registrar commonly associated with legitimate brand owners, suggesting potential abuse of compromised or mis‑issued credentials.

No TLS certificate was observed, leaving the site accessible only via HTTP, a characteristic often seen in hastily deployed phishing pages. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification. The page title "Sign in to your account" aligns with the claimed brand impersonation of Microsoft, confirming the intent to harvest login credentials. The domain has been listed on a single security blocklist and was actively blocked by the PhishDestroy service before being taken offline.

VirusTotal reported 17 detections out of 95 scanning engines, providing independent confirmation of malicious behavior. While the exact content of the landing page has not been captured, the convergence of the observed page title, brand target, and detection metrics strongly suggests a credential‑phishing campaign. Defenders should continue to block the domain at network perimeter controls, monitor for any residual traffic to the associated IP address, and update detection signatures to include the domain and its IP. Incident response teams should advise users to disregard any unsolicited Microsoft login prompts originating from this URL and to verify legitimate Microsoft communications through official channels.