programme-hup[.]m365-microsoft[.]com

This domain is flagged as a high-risk brand impersonation targeting Microsoft, with active credential phishing infrastructure. Registered on June 08, 2026, through Dynadot Inc, the domain resolves to IP 20.50.64.14, which is hosted on Microsoft Azure App Service in the North Europe region (IE). The hosting provider is legitimate, but the domain's use is malicious. The page title is 'Phishing Simulation Notice', which is a common lure to deceive users into believing they are viewing an official security test from Microsoft, thereby lowering suspicion and increasing the likelihood of credential submission. The domain uses Windows Server with IIS and an HSTS policy, and its SSL certificate is issued by Let's Encrypt (R13), a free certificate authority often abused by threat actors. Nameservers point to azure-dns.com and azure-dns.net, consistent with Azure DNS infrastructure. The Gridinsoft trust score is 0 out of 100, and VirusTotal reports 14 out of 91 security vendors flagging the domain as malicious. It appears on two security blocklists and is blocked by PhishDestroy and Phishunt. The domain is still active as of the report date. Defenders should block this domain at the network level, monitor for any related subdomains or new registrations using similar naming patterns, and search internal logs for any users who may have visited the domain or entered credentials. No further details about the phishing kit or exact page content are available in the provided intelligence.