skirtgrippys[.]com

Analysis shows skirtgrippys.com is an active brand‑impersonation campaign targeting Microsoft. The domain was registered on May 16, 2025 and resolves to IP 40.91.108.115, which is hosted in the Microsoft Azure West US2 cloud region. The TLS certificate presented by the server is issued to Microsoft Corporation by the Microsoft Azure RSA TLS Issuing CA 07, indicating that the attacker is leveraging a legitimate Azure certificate to increase trustworthiness. HTTP requests receive a 302 redirect, and the page title returned is "This website domain has been seized by Microsoft," a typical tactic to feign legitimacy. VirusTotal scans flag the domain in 20 of 91 security vendors, and the Gridinsoft trust score is 0/100, confirming a high likelihood of malicious intent. The domain is listed on two security blocklists and has been blocked by multiple threat‑intelligence feeds. Registration was performed through MarkMonitor, Inc., a registrar commonly associated with legitimate brand domains, suggesting possible abuse of a compromised or spoofed account. Nameservers ns001.microsoftinternetsafety.net, ns002.microsoftinternetsafety.net, and ns911a.micro are configured, further mimicking official Microsoft infrastructure. Defenders should block the domain at the network perimeter, monitor DNS queries for the associated IP and nameservers, and update intrusion‑detection signatures to include the observed HTTP 302 pattern and the specific certificate chain. Continuous monitoring of related Azure‑issued certificates is advised to detect potential reuse in other impersonation attempts.