cancelar-ahora[.]iceiy[.]com

PhishDestroy has identified cancelar-ahora.iceiy.com as a confirmed generic phishing domain, likely targeting users through deceptive credential theft tactics. The domain was registered on May 15, 2026, through Porkbun LLC, and its SSL certificate was issued by ZeroSSL, adding a veneer of false legitimacy. The site resolves to IP address 185.27.134.114 and appears on one security blocklist, indicating limited but confirmed malicious activity.

Technical indicators paint a clear picture of risk: VirusTotal flags this domain with 18 out of 95 security vendors marking it as malicious, a strong signal of widespread detection. The domain is currently offline, though its recent creation and the use of a free SSL provider suggest an attempt to rapidly deploy phishing infrastructure. No specific brand impersonation or crypto drainer kit was identified, but the generic nature of the phishing threat does not diminish its potential for harm.

The domain is now offline, which reduces immediate risk, but users should remain vigilant. PhishDestroy recommends monitoring for any related subdomains or IP addresses, as threat actors often reuse infrastructure. Avoid entering credentials or personal information on any sites associated with this domain, and report any suspicious emails linking to it. If you have already interacted with the site, change your passwords immediately and enable multi-factor authentication where possible.