japeconu[.]run

This domain japeconu.run is currently active and serves a single HTTP redirect (302) to an unspecified location. The page title returned by the server reads “This website domain has been seized by Microsoft”, indicating a brand‑impersonation attempt targeting Microsoft users. The domain was created on 10 April 2025 and is registered through MarkMonitor Inc., a registrar commonly used for legitimate Microsoft assets. DNS resolves to 40.91.108.115, an address allocated to a US‑based cloud infrastructure (westus2 region). The TLS certificate presented is issued to Microsoft Corporation by the Microsoft Azure RSA TLS Issuing CA 08, further mimicking legitimate Microsoft services. Nameservers are ns001.microsoftinternetsafety.net and ns002.microsoftinternetsafety.net, which are not publicly associated with Microsoft’s official DNS but are crafted to appear credible. Reputation services assign a Gridinsoft trust score of 0/100 and a Scamadviser score of 1/100, reflecting extreme risk. VirusTotal analysis shows that 18 of 91 scanners flagged the domain, confirming malicious behavior. The domain appears on two independent blocklists, confirming that security vendors have identified it as hostile. Uncertainty remains regarding the final landing page after the redirect and whether any credential‑harvesting forms are hosted. Defenders should block the domain at the network perimeter, update URL filtering and DNS sinkhole rules, and monitor for any outbound connections to the IP address 40.91.108.115. Incident response teams should treat any traffic from this domain as potentially compromised and advise users to ignore any messages claiming that the site has been seized by Microsoft.