app-seguros-727cad1a-1283c679[.]azurewebsites[.]net

The domain app-seguros-727cad1a-1283c679.azurewebsites.net was observed targeting Microsoft customers with a tech‑support impersonation campaign. The site resolved to IP 20.208.5.34, which belongs to AS8075 Microsoft Corporation and is geolocated in Switzerland. The HTTP service was hosted on Microsoft’s Azure platform, as indicated by the Azure‑specific nameserver ns1-azure.azure-dns.com and the registration record that lists Microsoft Corporation as the registrar. No TLS certificate was presented, meaning connections were unencrypted and vulnerable to interception.

The page title returned by the server was “Bei Ihrem Konto anmelden,” a German phrase meaning “Log in to your account,” which aligns with the social‑engineering narrative. Reputation services scored the domain extremely low: Scamadviser assigned a trust score of 1 / 100 and Gridinsoft gave 0 / 100, reflecting a high likelihood of malicious intent. VirusTotal analysis showed that 15 of 95 scanned security vendors flagged the domain, reinforcing the suspicion. The domain appears on one known security blocklist and is listed by Google Safe Browsing as a social‑engineering threat.

PhishDestroy has already taken the site offline, and the current status is reported as offline. While the offline state reduces immediate risk, the infrastructure demonstrates a pattern of abusing Azure hosting for brand‑impersonation scams. Defenders should continue to block the domain at network perimeter devices, monitor outbound DNS queries for the Azure sub‑domain pattern, and consider adding the IP address to threat‑intel feeds. Ongoing surveillance of Azure‑hosted domains that resolve to Microsoft‑owned IP ranges is recommended to catch similar abuse early.