calendar-invites[.]com

The domain calendar-invites.com has been identified as a high-risk brand impersonation threat, specifically targeting Microsoft under the guise of an Outlook 365 login portal. The domain is currently offline, though prior activity indicates it was designed to harvest credentials by mimicking legitimate authentication interfaces. Analysis confirms this as a deliberate attempt to deceive users into disclosing sensitive account information. Infrastructure analysis reveals the domain was registered through Amazon Registrar, Inc. on February 04, 2018, and resolved to the IP address 54.160.65.212. Security vendor assessments on VirusTotal indicate that 10 out of 95 detection engines flagged the domain as malicious. The domain appears on four distinct security blocklists, including entries in 50 threat intelligence pulses within AlienVault OTX. The SSL certificate is issued by Amazon, a common characteristic in cloud-hosted phishing infrastructure. The page title, "Outlook 365 Login," further corroborates the intent to impersonate Microsoft’s authentication services. Current status confirms the domain has been taken offline, though residual risk remains due to its prior use in credential harvesting campaigns. Organizations and users are advised to treat any prior interactions with this domain as compromised and initiate password resets for affected accounts. Network-level protections should be updated to include the domain and associated IP in blocklists. Monitoring for similar impersonation attempts—particularly those leveraging cloud-based registrars and SSL certificates—is recommended to mitigate future threats.