csu-notice-complete-106081[.]square[.]site

Analysis on 25 July 2026 indicates that csu-notice-complete-106081.square.site is currently offline, returning HTTP 404 and listed as taken offline. The domain, created on 5 February 2019 and registered through MarkMonitor, Inc., resolves to IP 74.115.51.5 which belongs to AS27647 Weebly, Inc. in the United States. DNS is served by four Amazon Route 53 nameservers (ns‑1248.awsdns‑28.org, ns‑1816.awsdns‑35.co.uk, ns‑311.awsdns‑38.com, ns‑810.awsdns), confirming that the site leveraged Amazon Web Services for hosting while the underlying platform appears to be Weebly. The site presented a TLS certificate issued by Let’s Encrypt (E7) covering the square.site subdomain, indicating the presence of HTTPS despite its offline state. Threat intelligence classifies the domain as a brand‑impersonation campaign targeting Microsoft and associates it with a tech‑support scam.

Scamadviser assigned a trust score of 1 / 100, and the domain is flagged by PhishDestroy and appears on one public blocklist. VirusTotal analysis shows that 12 of 95 scanning engines flagged the domain, reinforcing the malicious assessment. The page title recorded as “Home | Notice” provides no further context about the payload. Given the combination of low trust rating, multiple vendor detections, inclusion on blocklists, and its explicit impersonation of Microsoft, defenders should treat any traffic to this host as malicious.

Recommendations include updating firewall and proxy deny lists with the domain and its underlying IP, monitoring DNS queries for the associated AWS nameservers, and ensuring endpoint protection solutions are configured to block URLs associated with this certificate. Because the site is offline, ongoing observation should focus on potential re‑activation, similar naming patterns, or other square.site subdomains that may be used in future campaigns.