From this page:
https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-threat-intelligence#
you seems to list credomched.ru and cryptonas.ru as hostile:

But credomched.ru does (not longer?) exist. Or is there some Cyrillic letters in that page? Hard to see.
Refs:
PS2: I'm adding this issue here since the Sales Contact page for Defender Threat Intelligence is absolute crap.
From this page:
https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-threat-intelligence#
you seems to list credomched.ru and cryptonas.ru as hostile:

But credomched.ru does (not longer?) exist. Or is there some Cyrillic letters in that page? Hard to see.
Refs:
PS2: I'm adding this issue here since the Sales Contact page for Defender Threat Intelligence is absolute crap.