jocospt[.]shop

The domain jocospt.shop is currently active and classified as a high‑risk Microsoft brand‑impersonation site. Infrastructure analysis shows the domain resolves to IP 40.91.108.115, a Microsoft Azure WestUS2 host located in the United States. The SSL certificate presented is issued to Microsoft Corporation by Microsoft Azure RSA TLS Issuing CA 07, indicating that the attacker is leveraging a legitimate Microsoft‑issued certificate to increase credibility. The domain was created on 18 December 2018 and is registered through MarkMonitor Inc.; its authoritative nameservers are ns911a.microsoftinternetsafety.net and ns911b.microsoftinternetsafety.net, both appearing to be Microsoft‑controlled. HTTP requests receive a 302 redirect, and the only visible page title reads “This website domain has been seized by Microsoft,” which suggests a possible takeover page but provides no further content analysis. VirusTotal reports 19 of 91 security vendors flag the domain, and it is listed on two public blocklists. Defensive products PhishDestroy and CryptoFirewall already block the domain, and the Gridinsoft trust score is 0 / 100. Defenders should immediately block jocospt.shop at the DNS and proxy layers, add its resolving IP 40.91.108.115 to network‑level deny lists, and monitor for any traffic to the associated nameservers. Because the site presents a legitimate Microsoft certificate, additional verification of TLS fingerprints is recommended to detect potential certificate misuse. Continuous monitoring of the domain’s activity and periodic re‑scanning are advised to capture any changes in payload or hosting infrastructure.