office365microsoftlogin[.]com

The domain office365microsoftlogin.com is actively engaged in credential harvesting through brand impersonation targeting Microsoft. Analysis confirms the domain is designed to mimic legitimate Office 365 login portals, posing a high risk of unauthorized account access and data exfiltration. As of the latest assessment, the domain remains operational and unmitigated. Infrastructure analysis reveals the domain was registered on June 19, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, a registrar frequently associated with malicious registrations. It resolves to the IP address 172.197.176.182, geolocated in Malaysia under AS8075 (Microsoft Corporation), though this likely represents hijacked or misconfigured infrastructure. The domain appears on three distinct security blocklists and is flagged by 3 of 95 vendors on VirusTotal, indicating limited but growing detection coverage. Notably, the page title, "Login :: Damn Vulnerable Web Application (DVWA) v1.10 *Development*," suggests either an attempt to obfuscate malicious intent or exploitation of a compromised web application framework. The absence of an SSL certificate further undermines any perceived legitimacy and increases the likelihood of interception during credential transmission. Current status confirms the domain remains active, with no evidence of takedown or remediation. Organizations are advised to implement immediate network-level blocking of 172.197.176.182 and the domain office365microsoftlogin.com across all security gateways. Endpoint protection systems should be updated to recognize the domain and associated IP as malicious, with particular emphasis on detecting anomalous login page behavior. Users should be educated to verify domain authenticity before entering credentials, especially when prompted by unsolicited login requests. Given the high-risk nature of this campaign, incident response teams are encouraged to monitor for unauthorized access attempts linked to this infrastructure.