securewebcom-wstatic[.]iceiy[.]com

The domain securewebcom-wstatic.iceiy.com is identified as a credential phishing threat, designed to harvest user login credentials through deceptive means. At the time of analysis, the domain is offline, though prior activity suggests it was actively used in phishing campaigns. No specific brand impersonation has been confirmed, but the infrastructure aligns with typical credential theft operations targeting generic login portals or cloud services.

Infrastructure analysis reveals the domain was registered through Porkbun LLC and resolves to the IP address 185.27.134.102. It is flagged by 14 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100, indicating high malicious confidence. The domain appears on one security blocklist and was blocked by PhishDestroy. Notably, the creation date is recorded as May 05, 2026, which may suggest a typographical error in registration records or an attempt to evade temporal analysis. The SSL certificate is issued by ZeroSSL, a common choice for both legitimate and malicious domains.

As the domain is currently offline, immediate risk to users is reduced. However, organizations should monitor for re-emergence or similar infrastructure. Recommended actions include blocking the domain and associated IP (185.27.134.102) at the network perimeter, updating endpoint detection rules to flag related indicators, and educating users on recognizing credential phishing attempts. Security teams should also review logs for prior connections to this domain or IP to assess potential compromise.