2025supports2025[.]hstn[.]me

Analysis of 2025supports2025.hstn.me indicates an active, high‑risk Microsoft brand‑impersonation campaign hosted on infrastructure that has been publicly flagged. The domain, registered through Porkbun LLC on June 03, 2019, resolves to IP 185.27.134.129, which is assigned to AS34119 Wildcard UK Limited in Great Britain. The server returns HTTP 200 and presents a ZeroSSL ECC Domain Secure Site CA certificate, a common choice for malicious operators seeking encrypted delivery without reputable validation. Nameservers are the Byet.org set (ns1‑ns4.byet.org), further linking the site to shared hosting often abused for phishing. Reputation services rate the domain extremely low (Gridinsoft 0/100, Scamadviser 1/100), and ten of ninety‑five VirusTotal scanners have flagged it as malicious. The site appears on PhishDestroy and PhishingDB blocklists, confirming community detection. The page title observed is "Home," but no additional content analysis is available. The campaign is classified as a Tech Support Scam targeting Microsoft users, though the exact tactics employed on the page remain unverified. Defenders should block traffic to the domain and its resolved IP, monitor DNS queries for the associated Byet.org nameservers, and consider adding the host to internal block lists. Continuous observation is advised to detect any evolution of the payload or redirection behavior.