olsu[.]appwrite[.]network

This domain, olsu.appwrite.network, is flagged as a high-risk phishing resource targeting user credentials through a fabricated login interface. Analysis indicates the page title 'Sign~in to view' is designed to deceive users into submitting authentication details, likely mimicking a legitimate service. The domain was registered on March 11, 2026, and remains active as of July 12, 2026, resolving to the IP address 151.101.131.52. Infrastructure analysis reveals the use of Cloudflare, Varnish, and Fastly, which may obscure the true origin of the malicious activity and complicate takedown efforts. Technical indicators show the domain employs common web technologies such as Bootstrap, jQuery, HSTS, and Google Hosted Libraries, which are consistent with legitimate sites but are frequently leveraged in phishing campaigns to appear credible. The SSL certificate is issued by Certainly, providing encrypted connections that may further mislead users. The domain currently appears on one security blocklist and is detected by 12 out of 95 security vendors on VirusTotal, confirming its malicious classification. However, the specific phishing kit or targeted brand remains unidentified, limiting attribution. Defenders should prioritize blocking this domain at the DNS and web proxy levels to prevent user access. The IP address 151.101.131.52 should be monitored for additional malicious domains, as it may host further phishing resources. Given the domain's recent registration and active status, it is likely part of an ongoing campaign, and security teams should review logs for connections to this domain or IP within the past four months. No evidence suggests this domain is part of a broader malware distribution or command-and-control infrastructure, but continuous monitoring is recommended due to its persistence.