sopinternal-onmicrosoft.group
Appeared in the .group zone on Thursday, August 27, 2026; by the end of that day the census found active website about automotive. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The name mimics a Microsoft 365 tenant domain (sopinternal.onmicrosoft.com) with no legitimate reason for a third party to register it behind Cloudflare NS, but the live page is an unrelated cloned auto-repair site (Euroklasse Motorsports, San Diego) — a classic decoy while credential-harvest content is staged; no Microsoft login is served yet, so evidence stops short of confirmed phishing.
The domain 'sopinternal-onmicrosoft.group' is a clear typosquat of Microsoft's internal domain structure (mimicking 'onmicrosoft.com'), but the page content is a completely unrelated auto repair shop (Euroklasse Motorsports San Diego). This is a brand-squat with deceptive infrastructure: the domain name impersonates Microsoft's naming convention, yet hosts a legitimate business page, suggesting either hijacked infrastructure or an attempt to deceive visitors into trusting the domain via Microsof
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Thursday, August 27, 2026
Same data as JSON: /api/zone/domain/sopinternal-onmicrosoft.group. This page is not indexed by search engines and does not link to the site it describes.