Microsoft has purchased Corp.com for an undisclosed sum two months after the domain was advertised for sale at $1.7m.
The domain is believed to pose a danger to Microsoft's clients because of a "namespace collision" issue that occurs when domain names intended for exclusive use by an internal company network overlap with regular internet domains.
As a result of the collision, the Corp.com domain has been receiving an unending stream of passwords, emails, and other sensitive data from hundreds of thousands of Microsoft Windows PCs at major companies around the globe for years.
News of the transaction was broken by Brian Krebs on April 7. Previous owner of Corp.com, Mike O'Connor, told Krebs that he "hoped Microsoft would buy it because hundreds of thousands of confused Windows PCs are constantly trying to share sensitive data with corp.com."
Wisconsin resident O'Connor essentially did nothing with the domain since buying it 26 years ago. On April 6, he confirmed the sale of the domain to Microsoft for an undisclosed sum.
Microsoft said the acquisition of the domain was undertaken to protect the privacy of its customers.
In a written statement, the company said: “To help in keeping systems protected we encourage customers to practice safe security habits when planning for internal domain and network names.
“We released a security advisory in June of 2009 and a security update that helps keep customers safe. In our ongoing commitment to customer security, we also acquired the Corp.com domain.”
Commenting on the sale, Jake Moore, cybersecurity specialist at ESET, said: “Domains are highly sought after by criminal hackers to add value when sending out phishy communications. If this particular web URL was used unethically, it could have caused a huge amount of misunderstanding—along with other potential consequences—to a large number of Microsoft customers.
"A typical trait of cyber criminals is to purchase similar domains to well-known brands so that when victims quickly check the sender’s address, it may look legitimate. Therefore, scammers can take advantage of their victim believing this false validation from the sender, encouraging them to click on dodgy links and attachments.
"It goes without saying that people need to double check sender addresses and not act on any unsolicited communication.”