confirmacion-meta[.]iceiy[.]com

This domain is flagged for elevated-risk brand impersonation targeting Microsoft, specifically mimicking an Outlook verification process. The threat type involves credential harvesting through a fraudulent login interface designed to deceive users into submitting account credentials under false pretenses. Analysis indicates the domain was crafted to exploit trust in Microsoft’s authentication workflows, likely for account takeover or unauthorized access to sensitive data. Infrastructure analysis reveals the domain was registered through Porkbun LLC on April 18, 2026, and resolves to the IP address 185.27.134.154, hosted in the United Kingdom under I FastNet LTD. The SSL certificate is issued by ZeroSSL, a common choice for both legitimate and malicious domains. Detection metrics show 18 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist and was previously blocked by PhishDestroy. The page title, 'Outlook Verification,' directly aligns with the impersonation of Microsoft’s email authentication process. Mitigation steps for this threat type include immediate domain blacklisting at the network perimeter and endpoint levels. Security teams should prioritize reviewing logs for connections to 185.27.134.154 or the domain itself, particularly from systems where Microsoft 365 credentials are used. User awareness training should emphasize verifying URL authenticity before entering credentials, especially for pages labeled 'verification' or 'account confirmation.' Organizations are advised to enforce multi-factor authentication (MFA) to mitigate the impact of credential theft, and monitor for anomalous login attempts originating from the identified IP range or related infrastructure.