flowerexju[.]bet

PhishDestroy identifies flowerexju.bet as an active brand impersonation domain masquerading as Microsoft, deploying a fraudulent seizure notice to deceive visitors into surrendering credentials or downloading malicious payloads. The page title explicitly mimics Microsoft’s official seizure warning, leveraging social engineering tactics to exploit user trust in legitimate brand communications.

This domain was flagged by 20 security vendors on VirusTotal, with a total detection score of 20/95. Registered through MarkMonitor Inc., the domain resolves to IP 40.91.108.115 and was created on April 30, 2025. It has been blocked by PhishingDB and Maltrail, and carries a Google Safe Browsing (GSB) status indicating malicious activity.

As of this analysis, flowerexju.bet remains active and poses an elevated risk to users who may be lured by its Microsoft impersonation. Immediate action includes blocking the domain at the network level and advising end users to avoid all interactions. Remaining risk is high due to the domain’s recent creation and the use of SSL certificates mimicking Microsoft Corporation, increasing the likelihood of successful deception.