office[.]bluedoc[.]uk

This domain, office.bluedoc.uk, is identified as a high-risk brand impersonation threat targeting Microsoft. Analysis indicates the domain was designed to mimic legitimate Microsoft services, likely to deceive users into disclosing credentials or installing malicious payloads. The domain is currently offline but was previously active in phishing campaigns. Infrastructure analysis reveals the domain was registered on March 19, 2026, through Cloudflare, Inc. and resolves to the IP address 167.172.199.98, hosted by DigitalOcean, LLC in the United States. The domain is flagged by 21 of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly marking it as phishing. It appears on one security blocklist and uses a Let's Encrypt SSL certificate (serial number E8). The page title, "Wikipedia," further suggests an attempt to mislead users by presenting unrelated content. The domain has been taken offline, reducing immediate risk to users. However, organizations should remain vigilant, as similar infrastructure may be reused in future campaigns. It is recommended to block the domain and its associated IP at the network level, monitor for related indicators of compromise, and educate users on recognizing brand impersonation tactics. Security teams should also review logs for any prior connections to this domain or its IP to assess potential exposure.