synetiq[.]ciamlogin[.]com

Analysis of synetiq.ciamlogin.com confirms active phishing infrastructure targeting Microsoft account credentials. The domain, registered on February 3, 2023, through MarkMonitor, Inc., currently resolves to IP address 40.126.31.73 and presents a German-language login prompt with the page title 'Bei Ihrem Konto anmelden,' directly referencing Microsoft's authentication flow. As of July 12, 2026, the domain remains active and is flagged by 10 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on one security blocklist and is already blocked by PhishDestroy. The SSL certificate is issued to Microsoft Corporation, which may increase the likelihood of user deception due to perceived legitimacy. Defenders should treat this domain as high-risk for credential harvesting targeting German-speaking users. Immediate blocking at DNS and web proxy levels is recommended. No evidence currently suggests compromise of Microsoft infrastructure; the domain appears to be a third-party impersonation. Further investigation should focus on identifying associated campaigns and tracking the IP for additional malicious domains.