This report describes a phishing attack in which scammers disguise the domain "rnicrosoft" as the official Microsoft website. The essence of the scam lies in using the letters "r" and "n" placed side by side to visually imitate the letter "m" in password reset emails. Users who do not notice the substitution click the link and hand over their login credentials to the phishing site.

According to user seedless0, this trick is not new: the domain was first registered 12 years ago, and the scheme is regularly used by scammers.

Information about the domain owner was verified by user pgpndw and confirmed by the ScamsBot bot. According to WHOIS data, the domain is registered to a private individual based in the city of Sejong, South Korea. The initial registration took place in March 2012.

According to user san72, sometimes such domains can be used by companies for internal employee vigilance tests; however, in this case, the registration points to a third-party individual. Discussion participants, including user OrchidFlame36, note the high efficiency of the deception due to font characteristics and users habits of quickly skimming text.

The main recommendation from users OrchidFlame36 and Pitiful_Option_108 is to completely avoid clicking on links from unexpected emails. In the event of receiving a notification about the need to reset a password, users are advised to navigate to the company's official website manually, rather than using links in the email.