microssoft[.]live

The domain microssoft.live was registered on May 14 2026 through Unstoppable Domains Inc. It resolves to the IPv4 address 34.42.100.71, which is hosted on Google Cloud in the US (us‑central1). Authoritative nameservers are ns1.unstoppabledomains.com and ns2.unstoppabledomains.com. The site returns an HTTP 302 response and presents a TLS certificate issued by Let’s Encrypt (YR1). Threat intelligence flags microssoft.live as a high‑risk generic_phishing campaign. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal records a single positive detection out of 95 scanned vendors. AlienVault OTX references the domain in sixteen separate threat pulses, indicating repeated observation across multiple sources. Analysis of the visible page title—“microssoft.live | Unstoppable Domains | Unstoppable Domains”—suggests an attempt to masquerade as a legitimate service while exploiting the misspelled “microssoft” brand. No definitive evidence of credential‑stealing forms or malicious payloads has been captured, and the limited number of vendor detections leaves the exact phishing kit unknown. The short lifespan of the domain (created May 2026) and its rapid deployment further constrain the observable forensic window. Defenders should add microssoft.live and its resolving IP 34.42.100.71 to network deny lists and configure URL filtering to block any HTTP redirects to the domain. Continuous monitoring of DNS queries for similar homograph variations of the target brand is advised. Updating intrusion detection signatures to capture the 302 redirect pattern and the specific Let’s Encrypt certificate fingerprint can improve early detection. Where feasible, sinkholing the IP address may disrupt the campaign’s command‑and‑control channel.