eczakozmetik[.]net

The domain eczakozmetik.net is currently active and has been classified as a high‑risk brand‑impersonation site targeting Microsoft. Infrastructure analysis shows the domain was registered on May 22, 2024 through MarkMonitor, Inc., and resolves to IP address 40.91.108.115, which is hosted in a United States cloud environment (westus2 region). The domain uses nameservers ns001.microsoftinternetsafety.net, ns002.microsoftinternetsafety.net, and ns911a.micro, further linking it to Microsoft‑related infrastructure. An SSL certificate issued to Microsoft Corporation by a Microsoft‑affiliated Certificate Authority validates the connection, and HTTP requests receive a 302 redirect to a page titled "This website domain has been seized by Microsoft". Reputation services indicate severe distrust: Gridinsoft assigns a score of 0/100, Scamadviser 1/100, and 21 of 91 security vendors on VirusTotal flag the domain. It is listed on two blocklists (PhishDestroy and CryptoFirewall). While the exact page content beyond the title has not been examined, the observed indicators collectively confirm a deliberate attempt to impersonate Microsoft and to deceive users. Defenders should immediately block eczakozmetik.net at network and endpoint layers, monitor DNS queries for the associated nameservers, and incorporate the IP address and certificate details into threat‑intel feeds. Continuous re‑evaluation is advised to detect any changes in hosting or payload delivery.