lgamericaexternalentra[.]ciamlogin[.]com

Analysis indicates that the domain lgamericaexternalentra.ciamlogin.com is actively impersonating Microsoft, as classified under brand_impersonation with a high risk level. The domain resolves to the IP address 20.190.159.128 and is registered through MarkMonitor, Inc., with a creation date of February 3, 2023. The SSL certificate is issued to Microsoft Corporation, which may contribute to the site's deceptive appearance of legitimacy. The page title, 'Aanmelden bij uw account,' suggests a Dutch-language login interface, though the exact content and functionality of the site remain unconfirmed. Infrastructure analysis reveals the domain is flagged on one security blocklist and detected by 3 of 95 security vendors on VirusTotal, indicating limited but present detection coverage. The domain employs technologies such as jQuery and HSTS, which are consistent with legitimate login portals but are also commonly adopted in phishing campaigns to enhance credibility. The Gridinsoft trust score of 0/100 further supports the assessment of malicious intent. Defenders should prioritize blocking this domain at the network level, particularly in environments where Microsoft services are utilized. Monitoring for connections to the associated IP address (20.190.159.128) and reviewing logs for user interactions with this domain are recommended. Given the domain's registration under a reputable registrar, defenders should also assess whether additional domains under the same registrar exhibit similar patterns of brand impersonation. The domain remains active as of July 12, 2026, and should be treated as a confirmed phishing resource until further analysis or takedown occurs.