Проверка домена microsoft-support.website на фишинг и безопасность

Domain microsoft-support.website is flagged for brand impersonation, specifically targeting Microsoft to deceive users into surrendering credentials or downloading malicious software. This site mimics official Microsoft support channels to exploit trust, a common tactic in tech-brand impersonation schemes. There is no evidence yet of a crypto-draining kit deployed, but the risk of credential theft remains high due to the falsified branding and plausible domain naming. Criminals leverage such pages to harvest login details, session tokens, or distribute second-stage malware under the guise of legitimate support assistance.

Technical analysis reveals this domain was registered through ENOM, INC. on March 31, 2026, and resolves to IP address 185.80.3.92. The site secured an SSL certificate via Let’s Encrypt, likely to appear legitimate and evade browser warnings. Despite zero detections on VirusTotal (1/95 engines as of latest scan), this domain has already been flagged on three independent security blocklists including PhishDestroy and MetaMask. Google Safe Browsing (GSB) has not yet listed this domain, indicating a window of opportunity for exploitation before widespread recognition. These factors suggest an emerging threat actively trying to establish credibility while avoiding immediate detection.

This domain remains active and poses a significant risk due to its impersonation of a trusted technology brand. PhishDestroy and MetaMask have already implemented blocking measures, and SEAL has flagged the domain, demonstrating early detection by reputable security tools. However, given the low VT detection rate and absence from GSB, the window for user exposure persists. Users should avoid accessing this domain entirely. Administrators are advised to implement network-level blocks for 185.80.3.92 and monitor internal DNS resolution against the domain list. Remaining risk is moderate-to-high as this site may evolve tactics or migrate hosting to resume operations under new domains if flagged too broadly.