public company · US
Microsoft
MICROSOFT CORP
Software, cloud and productivity services; among the most frequently impersonated brands in phishing reports.
- Primary official domain
- microsoft.com
- Reviewed official domains
- 10 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- hotmaillinkedinmicrosoftoffice365onedriveoutlooksharepoint
- Label aliases
- Hotmail · LinkedIn · Microsoft · Office 365 · OneDrive · Outlook · SharePoint
- Official domains
- microsoft.com · hotmail.com · licdn.com · linkedin.com · live.com · lnkd.in · microsoftonline.com · office.com · +2 more (all)
- Generated spellings
- 400 tracked · 168 observed somewhere · 232 not observed (all)
Certificate domains matching this brand
Names identified in certificate logs that match this company or brand. A brand match does not indicate bad intent or malicious activity.
| Matching domain / name | Matched brand / domain | Match type | First CT observation | Latest CT observation | Distinct certificates | Relationship | Source-reported abuse | Details |
|---|---|---|---|---|---|---|---|---|
microsoft-int.com3,333 names · includes wildcard names | microsoft | Brand token in name | 2026-10-18 22:11 UTC | 2026-10-19 06:20 UTC | 2,568 | Not assessed | No report in sample coverage | |
auto-s28521942b100-pbi-kv-httpszone71.z71.w.api.fabric.microsoft-int.com | microsoft | Brand token in name | 2026-10-19 06:20 UTC | 2026-10-19 06:20 UTC | 1 | Issuer Microsoft TLS G2 RSA CA OCSP 02 | ||
*.z71.graphql.fabric.microsoft-int.comWildcard certificate name: a pattern, not an observed live host | microsoft | Brand token in name | 2026-10-18 22:32 UTC | 2026-10-19 06:20 UTC | 18 | Issuer Microsoft TLS G2 RSA CA OCSP 16 | ||
*.z71.userdatafunctions.fabric.microsoft-int.comWildcard certificate name: a pattern, not an observed live host | microsoft | Brand token in name | 2026-10-18 22:32 UTC | 2026-10-19 06:20 UTC | 18 | Issuer Microsoft TLS G2 RSA CA OCSP 16 | ||
*.z71.w.api.fabric.microsoft-int.comWildcard certificate name: a pattern, not an observed live host | microsoft | Brand token in name | 2026-10-18 22:32 UTC | 2026-10-19 06:20 UTC | 18 | Issuer Microsoft TLS G2 RSA CA OCSP 16 | ||
auto-s28521942b100-pbi-kv-httpszone51.z51.w.api.fabric.microsoft-int.com | microsoft | Brand token in name | 2026-10-19 06:20 UTC | 2026-10-19 06:20 UTC | 1 | Issuer Microsoft TLS G2 RSA CA OCSP 10 | ||
| 3,328 more names in this group (most recent shown) | ||||||||
pedidopago.com.br1 name | microsoft | Brand token in name | 2026-10-19 05:26 UTC | 2026-10-19 06:16 UTC | 4 | Not assessed | No report in sample coverage | |
gfedw.fabric.microsoft-int.comnotexistsghub.docker.pedidopago.com.br | microsoft | Brand token in name | 2026-10-19 05:26 UTC | 2026-10-19 06:16 UTC | 4 | Issuer YR1 | ||
Collected from public certificate-transparency logs since 2026-10-18; 21,530,509 log entries checked so far. 80 logs are read continuously by our CT resolver from the point it started following them; earlier entries are not covered. Names on an organization's official domains are recorded by the resolver for at most 100 names per registrable domain per day, so official-domain name and certificate counts are lower bounds. Times are CT log timestamps, which differ from certificate validity dates. Certificate counts include precertificates and final certificates as separate artifacts. The "Source-reported abuse" badge appears only when an independent source reported that exact name for this organization; a certificate name match never creates it, and "No report in sample coverage" is not a safety verdict. How CT works