office365[.]rricrosoft-offices[.]org

The domain office365.rricrosoft-offices.org has been identified as an active phishing site specifically targeting users through Microsoft brand impersonation. Analysis confirms the domain is designed to mimic legitimate Microsoft Office 365 login portals, likely to harvest credentials or distribute malicious payloads. The page title, 'Phishing Simulation Notice,' further suggests an attempt to deceive users into believing the interaction is part of a sanctioned security exercise, increasing the likelihood of successful compromise. Infrastructure analysis reveals the domain was registered on July 07, 2023, through DYNADOT LLC, a registrar commonly associated with abuse. It resolves to the IP address 20.50.64.14, geolocated in Ireland under AS8075 (Microsoft Corporation), which may indicate compromised or misconfigured infrastructure. The domain is flagged by 17 of 95 security vendors on VirusTotal, and it appears on two independent security blocklists, including PhishDestroy and Phishunt. The SSL certificate is issued by Let's Encrypt (R12), a common tactic to lend superficial legitimacy to malicious sites. As of the latest verification, the domain remains active and continues to pose a high risk to users. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to prevent access. Users who may have interacted with the site should immediately reset credentials for any associated accounts, enable multi-factor authentication, and scan systems for potential compromise. Security teams are encouraged to monitor for similar domains leveraging the same registrar or hosting patterns.