verifylogin[.]oautoffice[.]com

The domain verifylogin.oautoffice.com is identified as a credential phishing site targeting Microsoft 365 users. Analysis indicates the site impersonates Microsoft login portals to harvest corporate or personal credentials. The domain is currently offline, though prior activity suggests it was actively used for fraudulent login collection before detection and takedown efforts intervened. Infrastructure analysis reveals the domain was registered through Wild West Domains, LLC on April 14, 2026, and resolves to the IP address 172.86.88.127, hosted by a provider in the United States. Security vendors flagged the domain in 21 of 95 VirusTotal scans, indicating moderate consensus on its malicious nature. The site appears on one security blocklist, and its SSL certificate was issued by Let's Encrypt (serial number E7). The page title displayed during analysis was 'Loading content...', a common tactic to delay or obscure malicious content delivery. While the domain is currently offline, organizations should remain vigilant for similar impersonation attempts. It is recommended to block the domain and associated IP (172.86.88.127) at the network perimeter. Security teams should monitor for credential reuse attempts, particularly targeting Microsoft 365 accounts, and enforce multi-factor authentication to mitigate phishing risks. Historical indicators, including registrar details and SSL certificate data, should be incorporated into threat intelligence feeds for proactive detection.