The company used a court order to seize two RedVDS domains. The sites offered virtual desktops and server infrastructure to help hackers pull of cybercrime and scams.
Phishing scammers use rnicrosoft.com domain to impersonate Microsoft by replacing 'm' with 'rn' in typosquatting attacks that steal login credentials.
Microsoft has witnessed a surge in the use of this tactic since May 2025, as part of opportunistic campaigns targeting organizations across multiple industries and verticals.