onwebcall[.]us

The domain onwebcall.us has been identified as a high-risk brand impersonation threat specifically targeting Microsoft. Analysis confirms the domain was designed to mimic Microsoft services, likely to deceive users into disclosing sensitive credentials or executing unauthorized actions. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on June 12, 2026, and resolved to the IP address 198.187.31.85. It was flagged by 12 of 95 security vendors on VirusTotal, indicating widespread detection. The domain appeared on three security blocklists and was assigned a trust score of 0/100 by Gridinsoft. Technical indicators include the use of PHP and LiteSpeed technologies, along with a Sectigo Limited SSL certificate. The page title was recorded as 'Home,' a generic but common tactic to avoid immediate suspicion. Current status confirms the domain is offline, reducing immediate risk of active exploitation. However, organizations and individuals should treat this domain as malicious and maintain its inclusion in blocklists to prevent potential reactivation. Network defenders are advised to monitor for any resolution changes or renewed activity associated with 198.187.31.85. End users should be educated on recognizing brand impersonation tactics, particularly those involving Microsoft-themed lures. Historical logs should be reviewed for any prior interactions with onwebcall.us to assess potential compromise.