eczamedikal[.]org

PhishDestroy identifies eczamedikal.org as an active domain engaged in brand impersonation targeting Microsoft. The site displays a page titled 'This website domain has been seized by Microsoft,' tricking users into entering credentials or executing malicious transactions. The threat type is phishing deception with potential financial theft via crypto drainer payloads.

This domain was flagged by 21 out of 95 VirusTotal security vendors, placing it on multiple threat intelligence feeds including Maltrail. Resolving to IP 40.91.108.115, the domain was registered on May 22, 2024, through MarkMonitor Inc., a registrar known for legitimate services but often leveraged by malicious actors. The SSL certificate is spoofed to appear as issued by Microsoft Corporation. Despite its recent creation, the domain has already been added to one security blocklist, indicating early detection but ongoing malicious intent.

Users are strongly advised to avoid this domain entirely. If interaction has occurred, disconnect devices from networks and scan for malware. Report the domain immediately to PhishDestroy for blocking and include the IP 40.91.108.115 in firewall rules for proactive network defense. Monitor financial accounts for irregular activity and revoke any entered credentials. Only access Microsoft services through verified official domains (microsoft.com or office.com) via HTTPS.