docx-app-d7624292[.]azurewebsites[.]net

This domain, docx-app-d7624292.azurewebsites.net, poses a high-risk credential theft threat through Microsoft brand impersonation. The site mimics legitimate Microsoft login portals, displaying the page title 'Sign in to your account' to deceive users into entering sensitive authentication credentials. Infrastructure analysis confirms the domain is designed to harvest usernames, passwords, and potentially multi-factor authentication tokens, which could lead to unauthorized account access, data exfiltration, or further lateral movement within compromised environments.

Evidence supporting this assessment includes detection by 20 out of 95 security vendors on VirusTotal, classification as phishing by Google Safe Browsing, and presence on one security blocklist. The domain was registered through Microsoft on March 14, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. It resolves to IP address 20.208.5.128 within AS8075 (Microsoft Corporation), and uses a valid SSL certificate issued by Microsoft Azure RSA TLS Issuing CA 07, further enhancing its appearance of legitimacy. The domain's hosting on azurewebsites.net infrastructure, combined with the Microsoft-branded certificate, indicates a calculated effort to bypass initial suspicion.

Users who visited this domain should immediately revoke any entered credentials, particularly Microsoft account passwords and associated authentication tokens. Enable multi-factor authentication on all accounts if not already active, and monitor for unauthorized access attempts or suspicious activity. Network administrators should block the domain and its resolving IP (20.208.5.128) at the perimeter, and review logs for connections to docx-app-d7624292.azurewebsites.net or the seed identifier a8aa14. Given the domain's current offline status, organizations should remain vigilant for similar impersonation attempts leveraging Microsoft Azure hosting infrastructure or future-dated domain registrations.