owa-portal-rsmx[.]weebly[.]com

The domain owa-portal-rsmx.weebly.com is identified as a brand impersonation threat specifically targeting Microsoft. Analysis confirms the domain was actively impersonating Microsoft services, as evidenced by the page title 'Outlook' and its design intent to mimic legitimate Microsoft login portals. The domain is currently offline, but its prior activity and infrastructure warrant continued monitoring. Technical indicators reveal the domain was created on March 29, 2006, and registered through Safenames Ltd. It resolved to the IP address 74.115.51.9, located in the United States under AS27647 (Weebly, Inc.). The domain appears on two security blocklists and is flagged by 15 of 95 VirusTotal security vendors. The SSL certificate was issued by Let's Encrypt, with the common name 'E8.' Additional intelligence confirms the domain was blocked by PhishDestroy and PhishingDB, further validating its malicious classification. Current status indicates the domain has been taken offline, reducing immediate risk. However, organizations should proactively block the domain and its associated IP address (74.115.51.9) at the network level to prevent potential reactivation or rerouting. Security teams are advised to review logs for prior connections to this domain and conduct user awareness training to recognize brand impersonation tactics targeting Microsoft services. Monitoring for similar domains using the 'owa-portal' naming convention or Weebly-hosted infrastructure is recommended.