egean[.]ciamlogin[.]com

Analysis indicates that egean.ciamlogin.com is an active brand‑impersonation infrastructure targeting Microsoft users. The domain was registered through MarkMonitor, Inc. on 3 February 2023 and is hosted on Microsoft Azure infrastructure, as evidenced by the SSL certificate issued to Microsoft Corporation by Microsoft Azure RSA TLS Issuing CA 04 and by the resolved IP address 20.190.159.68, which belongs to AS8075 Microsoft Corporation and geolocates to Ireland. The site returns an HTTP 302 redirect and is served over HSTS‑enabled HTTPS. Reputation services assign extremely low scores (Gridinsoft 0/100, Scamadviser 6/100). VirusTotal scans show 6 of 95 security vendors flag the domain, and it is currently listed on one security blocklist and has been blocked by PhishDestroy. The page title “Aanmelden bij uw account” aligns with the reported tech‑support scam classification. No additional payload or page content has been publicly disclosed, so the exact phishing vector remains unverified. Defenders should add the domain to deny‑list rules, monitor DNS queries for the Azure DNS nameservers, and ensure that any credential‑capture attempts referencing Microsoft login flows are blocked. Continuous re‑scanning is recommended to detect any changes to the site’s content or hosting.