owasxwheks-mph9pg[.]fly[.]dev

This domain, owasxwheks-mph9pg.fly.dev, is a confirmed phishing site designed to impersonate Microsoft Outlook's webmail interface. Its primary objective is to harvest user credentials by presenting a fraudulent login page that mimics the legitimate Outlook Web App. Victims who enter their email addresses and passwords on this site risk unauthorized access to their accounts, potential data theft, and further exploitation in secondary attacks, such as business email compromise or identity fraud. The site's page title, '0utl00k Web App,' is a deliberate misspelling intended to deceive users into believing they are interacting with a legitimate service, while the use of leetspeak (replacing letters with numbers) is a common tactic to evade basic detection mechanisms. Analysis indicates this domain was registered on March 10, 2026, through Fly.io, a platform often exploited for hosting malicious infrastructure due to its ephemeral nature and ease of deployment. As of the latest assessment, the domain resolves to the IP address 66.241.124.91, located within AS40509 (Fly.io, Inc.) in the United States. It appears on one security blocklist and is flagged by 17 out of 95 security vendors on VirusTotal, with detections including 'phishing,' 'malicious site,' and 'credential theft.' The domain uses a Let's Encrypt SSL certificate (serial number E8), which, while providing encryption, does not validate the legitimacy of the site. The combination of these indicators—recent creation date, brand impersonation, and low detection rates—suggests a targeted campaign with a high likelihood of success against unsuspecting users. If a user has visited owasxwheks-mph9pg.fly.dev or entered credentials on the site, immediate action is required to mitigate potential damage. First, change the password for the affected Outlook or Microsoft 365 account and enable multi-factor authentication if not already active. Review the account for unauthorized access, including suspicious login attempts, email forwarding rules, or unfamiliar devices. Check connected applications and revoke access for any unrecognized third-party services. If the compromised account is used for work or organizational purposes, notify the IT or security team to assess potential lateral movement or data exposure. Additionally, monitor other accounts that may share the same password for signs of compromise. Users should also report the domain to their email provider or security team to aid in broader threat intelligence efforts.