grizzlqzuk[.]live

PhishDestroy identifies grizzlqzuk.live as an active brand impersonation site impersonating Microsoft, deploying a deceptive ‘domain seized’ page to deceive visitors. The domain resolves to IP 40.91.108.115 and is registered through MarkMonitor Inc., a registrar often exploited in fraudulent domain campaigns. Threat actors leverage Microsoft’s brand trustworthiness to trick users into downloading malware, entering credentials, or surrendering cryptocurrency under false pretenses, particularly leveraging the upcoming Windows 11 25H1 release to increase credibility. This domain was flagged by 22 of 95 VirusTotal security vendors and is blocked by Maltrail. It appears on 1 security blocklist and holds an SSL certificate issued to Microsoft Corporation, a tactic used to enhance visual legitimacy. Registered on April 30, 2025, grizzlqzuk.live is a recently activated threat with high deception potential, exploiting Microsoft’s corporate identity to bypass user suspicion. If you visited grizzlqzuk.live, do not enter any data or download files. Close the tab immediately. Scan your device with updated antivirus software and run a full system scan. Rotate passwords if you accessed the site from a work or personal account, and enable multi-factor authentication on all critical services. Report the domain to your network administrator or security team and avoid future access. Block the domain at your firewall or DNS level to prevent further exposure.