clatteqrpq[.]digital

PhishDestroy identifies clatteqrpq.digital as an active Microsoft brand impersonation domain presenting elevated risk to users. This domain employs deceptive tactics to mimic Microsoft branding, including a fraudulent SSL certificate issued to 'Microsoft Corporation' and a page title falsely claiming 'This website domain has been seized by Microsoft.' Such impersonation is designed to exploit user trust in Microsoft to distribute malware, steal credentials, or deliver malicious payloads.

Security intelligence confirms this domain was registered on April 30, 2025, through MarkMonitor Inc., a registrar commonly used for legitimate domains but also exploited in fraudulent registrations. The domain resolves to IP 40.91.108.115 and has been blocked by two prominent security blocklists: OISD and Maltrail. VirusTotal analysis reveals 21 out of 95 security vendors flagged this domain as malicious or suspicious, indicating a high level of consensus among threat intelligence platforms regarding its malicious nature. The combination of a legitimate-appearing SSL certificate, brand impersonation, and blocklist presence underscores the sophistication and intent behind this fraudulent domain.

To mitigate risk from this Microsoft brand impersonation domain, users and organizations should immediately block clatteqrpq.digital at the network and endpoint levels. Update DNS and firewall rules to prevent access to this domain and its associated IP address (40.91.108.115). Conduct security awareness training to educate users on identifying brand impersonation attempts, particularly those involving false claims of domain seizure or unauthorized access. Additionally, report this domain to Microsoft’s Cybercrime Unit and relevant threat intelligence platforms to aid in its rapid takedown and inclusion in global blocklists.