totplh[.]xyz

This domain is flagged as a high-risk brand impersonation targeting Microsoft. The domain totplh.xyz was created on May 16, 2026, and remains active as of July 12, 2026. It resolves to IP address 40.91.108.115, hosted in the United States on Microsoft Azure Cloud (westus2). The SSL certificate is issued to Microsoft Corporation by Microsoft Azure RSA TLS Issuing CA 07, which is unusual for a domain not operated by Microsoft. Nameservers are set to ns911a.microsoftinternetsafety.net and ns911b.microsoftinternetsafety.net, further suggesting an attempt to appear legitimate. The page title claims the domain has been seized by Microsoft, a common tactic in brand impersonation to deceive visitors into believing the site is official or under enforcement action. VirusTotal reports 18 of 92 security vendors flagging this domain as malicious, and Gridinsoft assigns a trust score of 0/100. AlienVault OTX lists the domain in 6 threat intelligence pulses, and it appears on one security blocklist. The HTTP status is 302, indicating a redirect, which could lead to a phishing page or other malicious content. Defenders should block this domain at the network level, monitor for related subdomains or IPs, and educate users that official Microsoft seizure pages would not be hosted on a .xyz domain. The exact content of the site has not been analyzed, but the combination of technical indicators and the page title strongly suggests a phishing or credential harvesting operation. Organizations should review logs for any access to this domain and investigate potential credentials entered on it.