outlook-office365[.]mgamt[.]com

This domain, outlook-office365.mgamt.com, is identified as a high-risk brand impersonation threat targeting Microsoft. Analysis indicates the infrastructure was designed to mimic Microsoft 365 login portals, likely to harvest user credentials or distribute malicious payloads. No evidence of a drainer kit was observed, but the domain’s structure and naming convention align with known credential phishing campaigns targeting enterprise users. Infrastructure analysis reveals the domain was registered on March 26, 2026, through Amazon Registrar, Inc., and resolved to the IP address 52.51.161.76, hosted on AWS EC2 in the eu-west-1 region (Ireland). At the time of assessment, 16 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing classified it as phishing. The domain also appeared on one security blocklist, further confirming its malicious classification. The domain is currently offline, likely due to takedown or suspension. However, residual risk remains for organizations that may have been exposed prior to its deactivation. Defenders are advised to monitor for any residual DNS queries or logs referencing this domain and to block the associated IP address (52.51.161.76) at the network perimeter. Users should be reminded to verify domain authenticity before entering credentials, particularly for cloud service portals.