policy-changes[.]onmicrosoft[.]aviasg[.]co

The risk level for the domain policy-changes.onmicrosoft.aviasg.co is elevated, and it poses a specific threat of brand impersonation. The domain appears to be crafted to deceive users into believing it is affiliated with or represents Microsoft, potentially leading to unauthorized data collection or dissemination of false information.

Infrastructure analysis reveals that the domain is registered through NameCheap, Inc., and was created on March 10, 2026. It resolves to the IP address 185.11.27.10, which is located in Lithuania and associated with AS211771 AVIA SOLUTIONS GROUP (ASG) PLC. The domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 19 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt, which is a common and reputable certificate authority, but this does not mitigate the risk of brand impersonation. The page title, 'Avia Solutions Group – the world’s largest ACMI provider | AviaSG,' further indicates that the domain is not genuinely related to Microsoft.

To mitigate the risks associated with brand impersonation, organizations and individuals should verify the authenticity of any communications or links received from this domain. Security teams should update their blocklists to include this domain and monitor for any related phishing campaigns. Additionally, users should be educated on recognizing and reporting suspicious domains that impersonate well-known brands, and multi-factor authentication should be enforced for all critical systems and accounts to prevent unauthorized access.