voznessxyy[.]life

PhishDestroy identifies voznessxyy.life as an active brand impersonation threat targeting Microsoft, leveraging deceptive domain registration and SSL spoofing to mislead victims. This domain masquerades as an official Microsoft seizure notice, creating a false sense of urgency to trick users into disclosing sensitive information or installing malware. The threat is currently classified as elevated due to its convincing replication of Microsoft's branding and infrastructure.

This domain was flagged by 21 out of 95 security vendors on VirusTotal, indicating widespread detection of its malicious nature. It resolves to IP 40.91.108.115 and is blocked by Maltrail, a reputable security solution. Registered through MarkMonitor Inc. on April 30, 2025, the domain employs an SSL certificate spoofing Microsoft Corporation to enhance its authenticity. Its recent creation and inclusion on security blocklists further underscore its malicious intent. The combination of these indicators—high detection rates, recent registration, and deceptive SSL—paints a clear picture of a sophisticated impersonation campaign.

To mitigate exposure to this threat, users and organizations should immediately block voznessxyy.life at the network level using DNS or firewall rules. Employees should be educated about the tactics used in brand impersonation scams, emphasizing the importance of verifying domain authenticity through official Microsoft channels. Security teams are advised to monitor for related domains registered around the same time or sharing similar naming conventions, as threat actors often deploy multiple variants to evade detection. Additionally, reporting this domain to Microsoft and relevant threat intelligence platforms can help disrupt the campaign and protect other potential victims.