https://ms25h22-update.pro/?utm_term=wn_ts3&utm_medium=paid&utm_source=fb&utm_id=120248158982650779&utm_content=120248159047570779&utm_campaign=120248158982650779
45.249.90.182 · Evoxtenterprise LA
Los Angeles, United States
10 days
200 · 61.7s
Valid· R13, Let's Encrypt, US
COMPLETED
windows-11-installation-kit
windows-11-installation-kit
Directives: skipAi, skipUnblocker, skipMobileVariant
technology | software_distribution | ecommerce | finance | other · 4/5/2026
The page at ms25h22-update.pro presents a Windows 11 Pro installation assistant with a page title and UI closely mirroring Microsoft's Windows 11 download experience. The domain is newly registered (10 days) and not owned by Microsoft, yet the page visually imitates Microsoft branding and uses multiple Microsoft assets in the page (fonts, logo references, and external scripts). This is a typosquat/cloned Microsoft Windows 11 download flow designed to harvest credentials or other user data by mimicking the official site. The page explicitly mimics Microsoft content while hosting on a suspicious, unrelated domain.
High risk; this is a clear impersonation of a Microsoft Windows 11 download page hosted on a newly registered domain. The page uses Microsoft branding cues and loads Microsoft assets and analytics scripts to appear legitimate, while the domain ms25h22-update.pro is not owned by Microsoft. The SPA-style implementation and absence of static forms suggest client-side credential collection via JavaScript bundles. This domain age (10 days) and the heavy external script load increase the likelihood of credential harvesting or malware distribution. The combination of brand impersonation, legitimate-looking UI, and WAF-likely evasion signals indicates a high threat to users attempting to download Windows 11 from this page.
Monitor