Highscore 42 · flagged Friday, October 30, 2026

es-office.org

Appeared in the .org zone on Friday, October 30, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

page impersonates a brand
matched: microsoft 365
+22
brand in page title, not in the name
matched: microsoft
+20
Registrar
Internet Domain Service BS Corp
Nameserver provider
Nameservers
ns.isp.fo, ns.isp.gd, ns.isp.st, ns.isp.vg
First-day state
active website
HTTP status
200
Page title
Microsoft Office — descargas directas de instaladores en español
Has a form
no
Brand echoed
—

Model opinions

Second opinionlooks like abusetarget: Microsoftconfidence 80%· claude-opus-5-5

A newly registered es-office.org uses Microsoft Office branding and logos to offer self-hosted 'direct' offline installers for every Office version back to 2003 (4.98 GB IMG/PKG files, no offsite links to microsoft.com). It sits on anonymous offshore nameservers (isp.fo/.gd/.st/.vg) with an offshore registrar, which fits a piracy or malware-delivery front squatting on the Office name rather than a credential phish.

First passlooks like abusetarget: Microsoftconfidence 95%· claude-haiku-4-5

The domain es-office.org impersonates Microsoft Office branding and layout to distribute software downloads, presenting itself as an official catalogue ('Catálogo independiente de programas de Microsoft Office') while using Microsoft's logos, product names, and visual design. This is a brand-squat distribution front, not a phishing form, but clearly abusive use of Microsoft's intellectual property to drive downloads under false authority.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Friday, October 30, 2026

Screenshot of es-office.org taken by the zone census on 2026-10-30

Same data as JSON: /api/zone/domain/es-office.org. This page is not indexed by search engines and does not link to the site it describes.