ferzja[.]xyz

The domain ferzja.xyz has been identified as a threat due to its impersonation of Microsoft. This specific domain was used to deceive users into believing it was an official Microsoft website, potentially leading to credential theft or other malicious activities.

Analysis indicates that ferzja.xyz was flagged by 18 out of 95 security vendors on VirusTotal, highlighting a significant level of suspicion and risk. The domain was created on June 16, 2025, and registered through MarkMonitor, Inc., a company known for domain protection services. It resolved to the IP address 40.91.108.115, which is located in the US and is part of the Microsoft Azure Cloud (westus2). The SSL certificate used was issued by Microsoft Azure RSA TLS Issuing CA 07, further attempting to lend credibility to the fraudulent site. The domain has been taken offline and appears on 2 security blocklists, including PhishDestroy and CryptoFirewall.

If a user has visited ferzja.xyz, they should immediately check their accounts for any unauthorized activity, especially any Microsoft-related accounts. It is recommended to change passwords and enable multi-factor authentication (MFA) if not already in place. Users should also run a full system scan with their antivirus software to ensure no malware was installed. Reporting the visit to the security teams of any affected services, such as Microsoft, is advised to stay vigilant and protect personal data.