activarcorreoelectronico[.]iceiy[.]com

The domain activarcorreoelectronico.iceiy.com is currently active and has been observed in a high‑risk phishing campaign. VirusTotal reports that five of ninety‑five scanning engines flag the domain as malicious, indicating that a subset of security products have identified suspicious behavior. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, reinforcing the assessment of malicious intent. Registration data shows the domain was created on 06 December 2020 through Porkbun LLC, a registrar that is frequently used by threat actors for rapid provisioning.

The authoritative name servers are ns1.byet.org through ns5.byet.org, which are typical of free or low‑cost hosting providers and may complicate takedown efforts. DNS resolution points to the IP address 185.27.134.125; no additional hosting details, such as autonomous system number or geographic location, are supplied in the available intelligence. No SSL certificate information, HTTP response codes, page titles, or Safe Browsing/OTX entries have been published for this host, leaving the web‑layer characteristics unverified.

Given the limited but consistent indicators—multiple vendor detections, blocklist presence, and active blocking by PhishDestroy—defenders should treat the domain as malicious. Recommended actions include adding the domain to internal block lists, monitoring DNS queries for the associated IP and name servers, and employing URL filtering solutions to prevent user access. Continuous re‑evaluation is advised, as further evidence such as page content or additional vendor detections may emerge.