login[.]security[.]onmicrosoft[.]aviasg[.]co

This domain is flagged as a high-risk brand impersonation phishing site targeting Microsoft users. Analysis indicates the domain is designed to mimic legitimate Microsoft login portals, specifically leveraging the onmicrosoft subdomain structure to deceive users into entering credentials. The threat type is classified as credential harvesting through brand impersonation, with no indications of additional payload delivery or crypto-draining functionality at this time. Infrastructure analysis reveals the domain was registered on March 13, 2023, through NAMECHEAP INC and currently resolves to the IPv6 address 2606:4700:20::681a:107, geolocated to Lithuania under AS211771 (AVIA SOLUTIONS GROUP PLC). VirusTotal detection metrics show 20 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is explicitly categorized as phishing by Google Safe Browsing. The SSL certificate is issued by Let's Encrypt (YR2), providing a false sense of security to potential victims. The page title, "Avia Solutions Group – the world’s largest ACMI provider | AviaSG," does not align with the domain's purported Microsoft login functionality, further indicating malicious intent. Mitigation requires immediate blocking of the domain and its resolving IP address across all security controls. Organizations should implement strict filtering rules to prevent access to domains containing "onmicrosoft" strings registered outside Microsoft's official infrastructure. User awareness training should emphasize the risks of credential submission on unexpected Microsoft login pages, particularly those hosted on third-party domains. Security teams are advised to monitor for successful authentications from this domain in authentication logs and initiate password resets for any affected accounts. The domain's continued activity status necessitates ongoing monitoring for changes in infrastructure or additional malicious functionality.