public company · US

Microsoft

MICROSOFT CORP

Software, cloud and productivity services; among the most frequently impersonated brands in phishing reports.

Primary official domain
microsoft.com
Reviewed official domains
10 (directory review; organization has not verified)
Directory source
BreachScout directory · Suggest a correction
Matching domains, 30 days
111
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
1
domains first source-reported within 30 days
First observed, 30 days
137
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
Not checked
No email-policy check yet

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
hotmaillinkedinmicrosoftoffice365onedriveoutlooksharepoint
Label aliases
Hotmail · LinkedIn · Microsoft · Office 365 · OneDrive · Outlook · SharePoint
Official domains
microsoft.com · hotmail.com · licdn.com · linkedin.com · live.com · lnkd.in · microsoftonline.com · office.com · +2 more (all)
Generated spellings
400 tracked · 1 observed somewhere · 399 not observed (all)

Certificate domains matching this brand

Names identified in certificate logs that match this company or brand. A brand match does not indicate bad intent or malicious activity.

Matching domain groups, 30 days
4
distinct registrable domains with a matching certificate name, by latest CT log time; not attacks
Reviewed official
0
groups on this organization's reviewed official domains, 30 days
Not assessed
4
groups with the brand in the name and no review; no judgement implied
Latest CT observation
2026-10-19 02:33 UTC
log timestamp, not issuance or collection time
Matching domain / nameMatched brand / domainMatch typeFirst CT observationLatest CT observationDistinct certificatesRelationshipSource-reported abuseDetails
microsoft-int.com1,477 names · includes wildcard names
microsoftBrand token in name2026-10-18 22:11 UTC2026-10-19 02:33 UTC889Not assessedNo report in sample coverage
auto-s28521937b100-pbi-kv-httpszoneda.zda.w.api.fabric.microsoft-int.com
microsoftBrand token in name2026-10-19 02:33 UTC2026-10-19 02:33 UTC1Issuer Microsoft TLS G2 RSA CA OCSP 02
*.zda.graphql.fabric.microsoft-int.comWildcard certificate name: a pattern, not an observed live host
microsoftBrand token in name2026-10-19 02:33 UTC2026-10-19 02:33 UTC1Issuer Microsoft TLS G2 RSA CA OCSP 02
*.zda.userdatafunctions.fabric.microsoft-int.comWildcard certificate name: a pattern, not an observed live host
microsoftBrand token in name2026-10-19 02:33 UTC2026-10-19 02:33 UTC1Issuer Microsoft TLS G2 RSA CA OCSP 02
*.zda.w.api.fabric.microsoft-int.comWildcard certificate name: a pattern, not an observed live host
microsoftBrand token in name2026-10-19 02:33 UTC2026-10-19 02:33 UTC1Issuer Microsoft TLS G2 RSA CA OCSP 02
auto-s28521937b100-pbi-kv-httpszoneba.zba.w.api.fabric.microsoft-int.com
microsoftBrand token in name2026-10-19 02:33 UTC2026-10-19 02:33 UTC1Issuer Microsoft TLS G2 RSA CA OCSP 16
1,472 more names in this group (most recent shown)
jfdir.com9 names
linkedinBrand token in name2026-10-18 22:33 UTC2026-10-19 02:33 UTC9Not assessedNo report in sample coverage
onmlkjwww.ehgfidcbalkjidde0604d0-f14d-49fa-848a-d1acc7altlinkedin123.t.jfdir.com
linkedinBrand token in name2026-10-19 02:33 UTC2026-10-19 02:33 UTC1Issuer ZeroSSL ECC DV SSL CA 2
nmwww.hkfedcfehgnmlkjidde0604d0-f14d-49fa-848a-d1acc7altlinkedin123.t.jfdir.com
linkedinBrand token in name2026-10-19 02:33 UTC2026-10-19 02:33 UTC1Issuer ZeroSSL ECC DV SSL CA 2
owww.jmlkjihcbidcnmlkjidde0604d0-f14d-49fa-848a-d1acc7altlinkedin123.t.jfdir.com
linkedinBrand token in name2026-10-19 02:33 UTC2026-10-19 02:33 UTC1Issuer ZeroSSL ECC DV SSL CA 2
nwww.ihgfedcfadcbmlgfedde0604d0-f14d-49fa-848a-d1acc7altlinkedin123.t.jfdir.com
linkedinBrand token in name2026-10-19 02:32 UTC2026-10-19 02:32 UTC1Issuer ZeroSSL ECC DV SSL CA 2
www.cbidcnmlkfedde0604d0-f14d-49fa-848a-d1acc7altlinkedin123.t.jfdir.com
linkedinBrand token in name2026-10-19 01:33 UTC2026-10-19 01:33 UTC1Issuer ZeroSSL ECC DV SSL CA 2
4 more names in this group (most recent shown)
dev.microsoft3 names · wildcard names only
microsoftBrand token in name2026-10-18 23:43 UTC2026-10-19 01:11 UTC6Not assessedNo report in sample coverage
*.rtmpingest.mcr.communications.core.dev.microsoftWildcard certificate name: a pattern, not an observed live host
microsoftBrand token in name2026-10-19 01:11 UTC2026-10-19 01:11 UTC1Issuer Microsoft TLS G2 RSA CA OCSP 04
*.eers.communications.core.dev.microsoftWildcard certificate name: a pattern, not an observed live host
microsoftBrand token in name2026-10-19 00:53 UTC2026-10-19 00:53 UTC4Issuer Microsoft TLS G2 RSA CA OCSP 10
*.lift.mcr.communications.core.dev.microsoftWildcard certificate name: a pattern, not an observed live host
microsoftBrand token in name2026-10-18 23:43 UTC2026-10-18 23:43 UTC1Issuer Microsoft TLS G2 RSA CA OCSP 04
mwood.org1 name
sharepointBrand token in name2026-10-18 22:34 UTC2026-10-18 22:34 UTC1Not assessedNo report in sample coverage
sharepoint.mwood.org
sharepointBrand token in name2026-10-18 22:34 UTC2026-10-18 22:34 UTC1Issuer ZeroSSL ECC DV SSL CA 2

Collected from public certificate-transparency logs (Cloudflare Nimbus2026, Google Argon2026h2, Google Xenon2026h2) since 2026-10-18; 45,290 log entries checked so far. Collection samples the newest entries of each log, so coverage is partial. Times are CT log timestamps, which differ from certificate validity dates. Certificate counts include precertificates and final certificates as separate artifacts. The "Source-reported abuse" badge appears only when an independent source reported that exact name for this organization; a certificate name match never creates it, and "No report in sample coverage" is not a safety verdict. How CT works