m365-owa[.]comDomain
Reported by 2 independent sources · first reported by Zscaler ThreatLabz · last reported
Last reported 2 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia“Between July 16 and July 23, 2026, UNC7005 registered three Microsoft Outlook Web Access (OWA) themed domains (owa-ms365.com, m365-owa[.]com, and ms365-device.com), which were later linked to the hospitality captive portal campaign, using the email [email redacted].”
-
CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials“m365-owa[.]com”
Indicators reported together
named in the same reports- ms365-device[.]comin 2 reports
- ms365-live[.]comin 2 reports
- owa-ms365[.]comin 2 reports
- 31.57.243[.]154in 2 reports
- 38.146.28[.]75in 2 reports
- 104.194.159[.]150in 2 reports
- be99857449d2856d…6b4970d8d42cin 2 reports
- 38.146.28[.]132in 1 report
- 107.189.26[.]194in 1 report
- 213.145.86[.]112in 1 report
- 918fa52ae45ed60b…4513be11c593in 1 report
- fewfwfwfwfwf[.]infoin 1 report
- 196.251.107[.]171in 1 report
- foreignrelations[.]usin 1 report
- 5b8d50c2e8cc3038…191ae67f8ffcin 1 report
- 1d9299799a7b8da6…3f6cbc843e3cin 1 report
- 107.189.18[.]7in 1 report
- c5826032207d623a…54f3e4420265in 1 report
- my-invite[.]orgin 1 report
- statistic-ms[.]livein 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.