owa-auth218-app-j8yvp[.]ondigitalocean[.]app

The domain owa-auth218-app-j8yvp.ondigitalocean.app has been identified as a brand impersonation threat specifically targeting Outlook users. Analysis confirms this domain was designed to mimic legitimate Outlook login pages, a tactic commonly employed in credential harvesting campaigns. The domain is currently offline, but prior activity indicates a deliberate attempt to deceive users into disclosing authentication credentials. Infrastructure analysis reveals the domain was flagged by 20 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was registered through Cloudflare, Inc. and resolved to the IP address 162.159.140.98, hosted on autonomous system AS13335 under Cloudflare’s infrastructure. The domain appeared on two security blocklists, including PhishDestroy and PhishingDB, further corroborating its malicious classification. No SSL certificate was present, increasing the likelihood of interception or manipulation of user data during transmission. As the domain is now offline, active exploitation is unlikely. However, organizations and users should remain vigilant for similar impersonation attempts. Security teams are advised to block the domain and associated IP at perimeter defenses, monitor for credential reuse from affected accounts, and implement multi-factor authentication to mitigate the impact of potential credential theft. Historical indicators, such as the IP and domain pattern, should be incorporated into threat intelligence feeds for proactive detection of related infrastructure.