VirusTotal
18 / 89
“This website domain has been seized by Microsoft”
18 / 89
4 threat-system alerts
Report7/14
checked — no match recorded
35 community references
Reportprovider verdict: clean
Reportstored report
Report Analysis completed
ReportChecked; no threat flag recorded
Report| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| Cloudflare DNS | www.noticeofpleadings.net |
malicious | Sinkholed |
| Quad9 DNS | clatteqrpq.digital |
malicious | Sinkholed |
| Hagezi Threat Feed | clatteqrpq.digital |
malicious | Sinkholed |
| DNS4EU | clatteqrpq.digital |
malicious | Sinkholed |
PhishDestroy identifies clatteqrpq.digital as an active Microsoft brand impersonation domain presenting elevated risk to users. This domain employs deceptive tactics to mimic Microsoft branding, including a fraudulent SSL certificate issued to 'Microsoft Corporation' and a page title falsely claiming 'This website domain has been seized by Microsoft.' Such impersonation is designed to exploit user trust in Microsoft to distribute malware, steal credentials, or deliver malicious payloads.
Security intelligence confirms this domain was registered on April 30, 2025, through MarkMonitor Inc., a registrar commonly used for legitimate domains but also exploited in fraudulent registrations. The domain resolves to IP 40.91.108.115 and has been blocked by two prominent security blocklists: OISD and Maltrail. VirusTotal analysis reveals 21 out of 95 security vendors flagged this domain as malicious or suspicious, indicating a high level of consensus among threat intelligence platforms regarding its malicious nature. The combination of a legitimate-appearing SSL certificate, brand impersonation, and blocklist presence underscores the sophistication and intent behind this fraudulent domain.
To mitigate risk from this Microsoft brand impersonation domain, users and organizations should immediately block clatteqrpq.digital at the network and endpoint levels. Update DNS and firewall rules to prevent access to this domain and its associated IP address (40.91.108.115). Conduct security awareness training to educate users on identifying brand impersonation attempts, particularly those involving false claims of domain seizure or unauthorized access. Additionally, report this domain to Microsoft’s Cybercrime Unit and relevant threat intelligence platforms to aid in its rapid takedown and inclusion in global blocklists.
Stored crawler-versus-browser observations for this host, plus a live fingerprint check for Keitaro-style traffic distribution systems.
nginx/1.28.3Scanner note: redirect: raw=redirect_302; http=302; via=https_proxy; location=https://www.noticeofpleadings.net/lumma/domainseizurenotice.htm; server=nginx/1.28.3
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
ns001.microsoftinternetsafety.netns002.microsoftinternetsafety.netLocation describes the IP network.
c2bc4d6f61ccf5134220386d922b0741488d68c507df18e54985d82c2cdf2c62agriwellness.worldaigjmr.digitalastrivee.worldbarmgek.digitalbegindecafer.worldbhgyuncovered.worldblackljjwc.runbloomingzgardens.todaybulgecont.runcampylloir.runchamelweon.digitalchemistrycworner.todaycoldshpwyb.rundatadynnamics.todayearthsymphzony.todayeasterxeen.runferrybarked.worldfirstezkpg.runfluffypxillow.todayfostinjec.todaygalxnetb.todaygetatasgop.digitalglobetrotfe.worldgoldensounew.worldhappyjh.worldhazperjurke.worldhunterinrx.runinflexcytv.digitalinterpwthc.digitaljoinfoulnz.digitallocalfarmerj.todaylsunarlandsc.digitalmachinehiub.digitalmadagaeyrk.runmaiantfuuk.runmarksmanm.todaymeerkaty.digitalmelteryb.digitalmetalfyz.digitalmetalsyo.digitalmetalupy.digitalmexratet.digitalmodmovel.digitalmodnextq.digitalmoduplifct.digitalmodupx.digitalmoldifye.digitalmoldprow.digitalmoonscik.digitalmustelxfzf.digitalnaturesartgistry.todaynetscoute.digitalnewpillr.digitalnewzeconi.digitalnightloqv.runnoblefamo.runnovapherex.digitalobeliske.digitalopenwq.digitalorbitixg.worldoreformr.digitaloreplusm.digitaloverlapseq.digitalowlflright.digitalpaincopp.digitalpaxthfinder.digitalpillowcxloud.worldpitchbcmst.digitalpixelcodey.digitalplugboth.digitalpolitewtod.runporcupineq.digitalproenhann.digitalquityt.digitalraisezx.runreflecwemy.runrelaxingxpillow.digitalreleasegjh.digitalrisevc.digitalroamers.todayrodformi.runromulusy.digitalrundowrlgr.runrushmn.digitalsacredtaxle.digitalscalemodm.digitalsceeptersong.digitalscieseandbeyond.worldscikevision.todayscriptao.digitalshiftvc.digitalshootforyou.worldsidebyafzy.digitalskylinejo.worldslothwe.digitalslowdomkaf.runsmartbitsx.digitalsmartdatac.runsmeltingt.runsnipersecrets.worldsoarxvc.runsolarnatgure.runsoliduso.digitalsolsoftt.digitalsorcery.digitalspacedbv.worldspacetimech.todaysparkiob.digitalspaxicox.todaystatibesearch.worldstylefnez.digitalsubnorrepg.runsumeriavgv.digitalswordandsr.digitaltaleweaiver.runtaskrunp.runtechguidet.digitaltendolihyy.digitalthnnkzt.digitaltiltvc.digitaltonedanswered.todaytravelio.digitaltriggerte.digitaltripfflux.worldtriphmind.worldtriremeo.digitaltrsipbeat.worldtrzipwise.digitalunbinddas.digitalunicornu.digitalvaluesads.runvalvulnsuq.runvanceteo.runvictoreqs.runvqalkyrieong.runwawrdenshire.digitalweaponrywo.digitalweaponswh.runweavegfg.digitalwebpointsl.runweldmaxi.digitalweldorae.digitalwildlnifeecho.worldwilrdadventur.digitalwizardrry.digitalwolfestandt.runwoodpeckersd.runwoodrebough.runwwwsyju.digitalxmedresp.runzestyasd.runzootechq.runSaved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
11 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
Capture the rendered page, requests and visible infrastructure.
Compare the available engine results and retain the analysis timestamp.
Check whether Google currently lists the URL as unsafe.
Inspect a public scan and its recorded network and classification data.
Look for indicator references and related community intelligence.
Compare archived captures and preserve historical context.
Look for matching indicators and associated threat records.
Inspect certificate records and related hostnames.
Compare security resolver responses and record observed blocking.
Inspect the public DNS, TLS, HTTP and technology surface.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
Reported by 1 community member, first seen May 5, 2026
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Select your country to get official cybercrime contacts, or create a complaint draft →.
Template-based draft · optional AI wording assistance requires separate consent
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowSubmit suspicious domains to our threat database — protect the community
ReportRecent phishing reports and observed availability changes
MonitorMonitor live threats or contest this listing if you believe it's a false positive