comunicaciones[.]iceiy[.]com

comunicaciones.iceiy.com is currently active and hosts a credential phishing page targeting Microsoft accounts, as indicated by the page title “Iniciar sesión en tu cuenta Microsoft”. The site resolves to IP 185.27.134.98, which belongs to AS34119 Wildcard UK Limited and is geolocated to the United Kingdom. The domain was registered on 2020-12-06 through Porkbun LLC and uses the nameservers ns1.byet.org through ns5.byet.org. TLS is provided by a ZeroSSL ECC DV certificate issued by ZeroSSL GmbH, confirming that HTTPS connections are encrypted but do not imply legitimacy. Infrastructure analysis shows the web server runs Nginx with OpenResty, and the page loads libraries from jsDelivr, jQuery, and Google Hosted Libraries. The domain appears on one security blocklist and is listed as blocked by PhishDestroy. VirusTotal reports 18 of 91 security vendors flag the domain as malicious. A Gridinsoft trust score of 0/100 further reinforces the malicious assessment. The threat is classified as brand impersonation, specifically a Microsoft credential phishing campaign. No additional malicious payloads or secondary infrastructure have been observed, leaving the extent of victim reach unknown. Defenders should block network traffic to 185.27.134.98 and to the domain comunicaciones.iceiy.com, monitor DNS queries for the associated BYET.org nameservers, and add the domain to email filtering rules that detect Microsoft‑related phishing subjects. Continuous monitoring of the IP reputation and periodic re‑scans on VirusTotal are recommended to capture any changes in detection coverage.