easterxeen[.]run

PhishDestroy identifies the domain easterxeen.run as an active brand impersonation site targeting Microsoft, a tactic frequently used to trick users into surrendering sensitive credentials or downloading malware under the guise of official communications. This site falsely claims 'This website domain has been seized by Microsoft' in its page title, a common scare tactic to pressure users into immediate action without scrutiny. Analysis shows the domain resolves to IP 40.91.108.115 and leverages a fraudulent SSL certificate issued to 'Microsoft Corporation', heightening its credibility while masking malicious intent. The domain was registered through MarkMonitor Inc. on April 30, 2025, a known registrar often abused by cybercriminals for short-lived malicious campaigns. Security vendors have escalated their scrutiny, with 19 out of 95 scanners on VirusTotal identifying this domain as malicious, and it has been blocked by two independent threat intelligence platforms—PhishingDB and Maltrail. This combination of a newly created domain, high VT detection rate, and active abuse of Microsoft’s brand creates an elevated risk profile, indicating a deliberate attempt to exploit trust for financial or data theft purposes. If you visited this website, cease interaction immediately and avoid entering any personal or credential information. Review your device for unusual activity, change passwords for critical accounts (especially Microsoft-related services), and run a full antivirus scan to detect potential malware. Report the domain through your browser’s safe browsing tools or to your organization’s security team to help prevent further victimization. Exercise heightened caution with unsolicited communications referencing account seizures or urgent actions involving Microsoft services.