Okta sign-in look-alike domains named after SaaS companies, on 196.251.121[.]218

Look-alike domains for Okta single sign-on pages of specific companies, registered since September 2026 and hosted on one server, 196.251.121[.]218: the company name joined to okta (attentive-okta[.]com, yotpo-okta[.]com, paddleokta[.]com, moengageinc-okta[.]com, contentfulokta[.]com, oktadialpad[.]com, listrak-okta[.]com), plus ServiceNow ticket look-alikes (servicenow-ticket[.]com and numbered variants) and vzw-web-portal[.]com. Naming a domain after one target company's identity provider is the pattern of voice-phishing campaigns that call employees and walk them through a fake sign-in or MFA reset. The server answers automated visitors with a short "Service temporarily unavailable" error, so no page content has been captured, and most of the domains were suspended within days of registration. A match means a scan of one of these domains or of the server.