Not all of them where impersonating Microsoft domains. Still can't understand how Microsoft managed to take these domains down if they weren't hosted by Microsoft in the first place.