owa[.]itineraryupdate[.]com

As of July 29, 2026, owa.itineraryupdate.com is under investigation for suspected credential phishing activity. The domain is currently flagged by 14 out of 91 security vendors according to recent VirusTotal records, indicating a noteworthy consensus among threat detection platforms. Furthermore, at least one public security blocklist includes this domain, reinforcing its reputation as a potential risk.

PhishDestroy, a known threat intelligence provider, has also placed this domain on its blocklist, further corroborating its association with credential harvesting campaigns. There is no information provided about the site’s page content, hosting provider, SSL certificate details, or HTTP status, and no specific brands or phishing kits are named in the available intelligence. Thus, while the operational characteristics and targeting specifics remain unclear, the multi-vendor detection and blocklisting by reputable sources represent concrete indicators of ongoing malicious use.

Analysts have not confirmed the full scope of the associated phishing mechanisms, but the evidence suggests defenders should treat owa.itineraryupdate.com as an active threat. Security teams are advised to add this domain to their blocklists, monitor for access attempts, and remain alert for related indicators of compromise. Further technical investigation is warranted to determine the full nature and impact of the phishing campaign linked to this domain.