validate-gobmx[.]iceiy[.]com

PhishDestroy identifies validate-gobmx.iceiy.com as an active generic phishing domain hosting a credential harvesting kit targeting unsuspecting users under the guise of validation services. The domain does not appear to impersonate a specific brand but leverages generic lures to deceive visitors into entering sensitive information. The infrastructure supports a phishing drainer kit designed to siphon credentials and session tokens, likely distributed via spam emails, fake ads, or compromised redirects. This campaign prioritizes mass targeting over brand-specific deception, exploiting trust in generic validation narratives.

Technical analysis confirms the following indicators: the domain was registered through Porkbun LLC, resolved to IP address 185.27.134.163, and carries a ZeroSSL certificate. The domain was created on December 06, 2020, and currently exhibits a VirusTotal detection score of 13 out of 95 security vendors. While Google Safe Browsing (GSB) status is not explicitly confirmed in the dataset, the low VT score indicates limited but active detection across security ecosystems. The domain remains unlisted on major blocklists as of latest checks, suggesting ongoing operational status without widespread takedown enforcement.

Current status remains active as of seed 2f5e07. Immediate response actions include DNS and IP blocking of 185.27.134.163 and validate-gobmx.iceiy.com across networks and endpoints. Users are advised to avoid any interaction with the domain, including links or attachments. Security teams should flag the domain in proxy filters and email gateways, and monitor for related infrastructure pivots. Remaining risk is elevated due to active use and low blocklist coverage. Proactive takedown requests to the registrar and hosting provider are recommended, alongside user awareness campaigns to reduce exposure to generic phishing lure campaigns.