mlcrosoft[.]co[.]com

Analysis of mlcrosoft.co.com, observed as offline as of the report date, shows definitive indicators of a brand impersonation campaign targeting Microsoft. The domain was registered on March 06, 2026 through Moniker Online Services LLC and resolves to IP address 172.67.195.41, which belongs to the Cloudflare network (AS13335) located in the United States. The site presented an HTTP 403 response and served a TLS certificate issued by Let’s Encrypt (E8), confirming the use of publicly available encryption.

The page title "GRIDFLOW // AUTH" was recorded, but the content of the page has not been captured, leaving the specific payload or credential‑capture mechanisms uncertain. The domain appears on three reputable security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reporting indicates that one of ninety‑four scanning engines flagged the domain, reinforcing the malicious assessment despite the low detection count.

The infrastructure—shared Cloudflare IP, generic certificate, and common nameserver set (ns1‑ns4.nic.co.com)—suggests the operator leveraged widely available hosting and DNS services to obscure attribution. Given the confirmed impersonation of Microsoft and the presence on multiple blocklists, defenders should continue to deny any traffic to this domain, update URL filtering policies to include it, and monitor for similar typosquatting variants that may reuse the same registration or hosting patterns. Further investigation is warranted to obtain the full page content and any associated payloads, but existing evidence justifies an elevated risk rating and immediate remediation actions.