segurity-verificacion365-1[.]iceiy[.]com

This domain, segurity-verificacion365-1.iceiy.com, is identified as a credential theft operation designed to harvest user login credentials under the guise of security verification. Analysis indicates the site mimics legitimate authentication portals, likely targeting individuals through deceptive emails or messages prompting urgent account validation. The infrastructure is engineered to capture sensitive information such as usernames, passwords, and potentially multi-factor authentication codes, which can be exploited for unauthorized account access or sold on underground markets. Infrastructure analysis reveals the domain was registered through Porkbun LLC on December 06, 2020, and resolves to the IP address 185.27.134.164, hosted by I FastNet LTD in the United Kingdom. At the time of assessment, the domain appears on one security blocklist and is flagged by 23 out of 95 security vendors on VirusTotal. The SSL certificate is issued by ZeroSSL, a common provider for both legitimate and malicious domains, which does not mitigate the elevated risk. The page currently displays a 'Domain Suspended' notice, suggesting recent takedown efforts or operational changes by the threat actors. Users who visited segurity-verificacion365-1.iceiy.com or entered credentials on the site should immediately take corrective action. First, reset passwords for any accounts accessed or potentially exposed through the domain, prioritizing email, financial, and administrative accounts. Enable multi-factor authentication where available, using app-based or hardware tokens rather than SMS-based methods. Monitor accounts for unauthorized activity, including logins, transactions, or configuration changes. If financial or personally identifiable information was submitted, consider placing a fraud alert or credit freeze with relevant bureaus. Report the incident to organizational security teams or consumer protection authorities to aid in broader mitigation efforts.