info[.]remote-otp[.]com

The domain info.remote-otp.com was registered on March 14, 2026 through Tucows Domains Inc. and resolves to the Amazon AWS IP address 52.19.203.170, which is allocated to an Irish ASN (AS16509). The DNS infrastructure is provided by Technorail and Aruba DNS services, as indicated by the four nameservers dns.technorail.com, dns2.technorail.com, dns3.arubadns.net, and dns4.arubadn. The site presents a login page titled "Sign in to your Microsoft Account," directly impersonating Microsoft’s authentication portal. HSTS is enforced, and the TLS certificate is issued by Sectigo Limited under the Sectivo Public Server Authentication CA DV R36 chain, confirming a valid HTTPS connection despite the malicious content.

Technical analysis shows the site is classified as a tech‑support scam, employing brand impersonation to lure victims into providing credentials. VirusTotal scans have flagged the domain in 14 of 95 vendor detections, and the domain appears on a single security blocklist, currently blocked by PhishDestroy. The Gridinsoft trust score of 0/100 further indicates a high likelihood of malicious activity. While the page returns HTTP 200, no additional malicious payloads have been observed beyond the credential‑harvesting form, leaving the full scope of the campaign uncertain.

Defenders should block the domain at perimeter firewalls and DNS resolvers, monitor for outbound connections to the associated AWS IP, and enforce strict MFA and conditional access policies for Microsoft accounts. Incident response teams should also advise users to verify URLs before entering credentials and to report any unexpected login prompts that reference Microsoft services. Continuous monitoring of the associated IP range and related nameservers is recommended to detect any future infrastructure changes that may support expanded phishing operations.