uz07web[.]us

On 24 July 2026 the domain uz07web.us was observed as an offline site that had been registered on 26 February 2026 through NameCheap, Inc. The authoritative name servers dns1.namecheaphosting.com and dns2.namecheaphosting.com resolve the domain to the IPv4 address 68.65.123.60, which is announced by AS22612 belonging to Namecheap, Inc. and geolocated to the United States. The host presents a LiteSpeed web server and serves a default Namecheap parking page, as indicated by the page title “Namecheap Parking Page”. The TLS certificate presented is issued by Sectigo Limited under the “Sectigo Public Server Authentication CA DV R36” authority, confirming a valid SSL handshake but offering no evidence of malicious payloads. The HTTP response returned a 200 OK status with only the default parking placeholder, providing no further indicators of credential‑capture pages.

Reputation data shows the domain appears on three security blocklists and has been blocked by the PhishDestroy, MetaMask, and SEAL filtering services. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of abuse. VirusTotal analysis records two detections out of ninety‑three scanning engines, corroborating the suspicion. The domain is explicitly marked as impersonating Microsoft, aligning with the “brand impersonation” threat type.

Because the site is currently offline, active content cannot be inspected, and the exact phishing kit or credential‑stealing mechanisms remain unknown. However, the convergence of low trust scoring, blocklist presence, multiple vendor detections, and the Microsoft impersonation claim indicates a credible threat that could be re‑activated or used in future campaigns. Defenders should continue to block the domain at network perimeter devices, update DNS filtering rules to include the associated IP address, and monitor for any resurrection of the domain or related sub‑domains.