owa[.]cordblood[.]com

This domain, owa.cordblood.com, has been identified as a brand impersonation threat specifically targeting Outlook users for credential theft. Analysis confirms the domain is currently offline, though prior activity mimicked the Outlook Web App interface to deceive users into submitting login credentials. The threat type aligns with credential harvesting campaigns, where attackers replicate legitimate authentication portals to capture sensitive account information. Infrastructure analysis reveals the domain was created on June 06, 1996, and is registered through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains. The domain resolves to the IP address 18.215.74.145, hosted on infrastructure belonging to Amazon.com, Inc. (AS14618) in the United States. Security vendors have flagged this domain, with 17 out of 95 VirusTotal engines detecting it as malicious. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued for owa.cordblood.com, which may have been used to lend an appearance of legitimacy to the fraudulent page. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the historical threat posed by this domain remains significant given its long-standing registration and targeted impersonation of a widely used email service. Organizations and users are advised to block the domain and its associated IP address at the network level. Security teams should monitor for any re-emergence of this domain or similar variations under new infrastructure. End-users should be educated on recognizing brand impersonation tactics, particularly those involving login portals, and encouraged to verify domain authenticity before entering credentials. Proactive measures, such as implementing multi-factor authentication and domain-based message authentication, can mitigate risks associated with credential theft campaigns.