owa-production-26ca[.]up[.]railway[.]app

This domain, owa-production-26ca.up.railway.app, is actively impersonating Microsoft's Outlook service. It poses a high risk of brand impersonation, which means it is designed to trick users into believing they are interacting with a legitimate Microsoft website. This can lead to the theft of sensitive information such as login credentials, personal data, and financial details.

Analysis indicates that the domain is currently active and has been flagged by 11 out of 95 security vendors on VirusTotal. The domain was created and is hosted in the United States under the AS400940 Railway network and resolves to the IP address 69.46.46.113. The SSL certificate is issued by Let's Encrypt, which is a common practice among phishing sites to appear more legitimate. The page title 'Outlook' further enhances the deception, making it appear as if users are accessing a genuine Microsoft service.

If a user has visited this domain, it is recommended to immediately change passwords for any Microsoft accounts, monitor account activity for any unusual behavior, and run a full system scan for malware. Users should also report the incident to their organization's IT department or a trusted security service. To avoid future risks, always verify the URL and SSL certificate of any Microsoft-related website and be cautious of unsolicited emails or messages directing to login pages.