validacionesuser[.]iceiy[.]com

Analysis indicates that the domain validacionesuser.iceiy.com is actively hosting a Microsoft brand impersonation page. The site returns HTTP 200 and presents the page title 'Iniciar sesión en tu cuenta Microsoft', which aligns with the declared brand target. The domain was registered through Porkbun LLC on December 06, 2020 and uses the nameservers ns1.byet.org through ns5.byet.org. DNS resolution points to IP 185.27.134.33, an address owned by AS34119 Wildcard UK Limited in Great Britain. The server presents an SSL certificate issued by ZeroSSL ECC Domain Secure Site CA, confirming the presence of HTTPS.

Technology fingerprinting shows Nginx with OpenResty, jQuery, and several Google services including Tag Manager, Hosted Libraries, Analytics, and AdSense. Security profiling shows a Gridinsoft trust score of 0/100. VirusTotal analysis has flagged the domain in 17 of 91 scanners, and the domain appears on at least one external blocklist. It is also listed as blocked by PhishDestroy. The combination of active HTTP response, valid TLS, low trust score, and multiple vendor detections elevates the risk to high.

While the exact page content beyond the title has not been publicly documented, the observed indicators confirm a hostile infrastructure aimed at credential harvesting for Microsoft accounts. Defenders should add the domain and its resolved IP to network deny lists, ensure endpoint web filters block the URL, and monitor for any traffic to the associated IP range. Continuous re‑scanning on VirusTotal and inclusion in collective threat‑sharing feeds are recommended to maintain visibility. Attribution to the hosting provider or underlying phishing kit cannot be confirmed at this time, so further investigation of the server’s response body and potential command‑and‑control channels is advised.