Phishing detection: office365.rricrosoft-offices.org

Microsoft
https://office365.rricrosoft-offices.org/i/df3667320560f4a8a9918ef9f3f4c4383 Access site
Screenshot
Screenshot of office365.rricrosoft-offices.org
Investigate
Domain office365.rricrosoft-offices.org1 CT host on apex
urlscan page.domain VirusTotal Whois
IP 20.50.64.14
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://office365.rricrosoft-offices.org/i/df3667320560f4a8…
urlscan Wayback archive.today
Cert R12
crt.sh Censys Google CT
Phishunt analysis Beta
20 low suspicionheuristic risk score · not a probability
Keyword matchLong domainBrand impersonation in path
16 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting

Impersonates Microsoft Office 365 via a domain typosquatting 'microsoft' with a double-r substitution. Login keywords detected in page text and the domain is hosted on Microsoft Azure in Ireland. Flagged by OpenPhish as malicious.

Brand impersonation in pathLogin text in screenshotOpenPhish
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-23 · confidence 85%
Domain & Network
Whois
Registrar Dynadot Inc
Network
IP 20.50.64.14
Country IrelandIreland
Hosting Microsoft Corporation
ASN AS8075
TLS Cert R12
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Related infrastructure Betasuspected links from shared infrastructure, not attribution
office365.internal-alerts.com 40 similar name same favicon same screenshot
active 2026-03-28
security.m365-microsoft.com 25 same favicon same screenshot same kit
active 2026-06-06
support.m365-microsoft.com 25 same favicon same screenshot same kit
active 2026-03-28
Top 3 of 3 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Report this phishing
Network / ASN Microsoft Corporation
abuse@microsoft.com Web form
Registrar Dynadot Inc
abuse@dynadot.com
Brand owner Microsoft
phish@office365.microsoft.com Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-06-17 01:06 UTC  ·  Last refreshed 2026-07-27 01:30 UTC