sguridadvalidaraccsoffcwtpp[.]iceiy[.]com

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Microsoft login credentials. Analysis indicates the infrastructure is designed to mimic Microsoft’s authentication portal, as evidenced by the page title 'Iniciar sesión en tu cuenta Microsoft,' which directly replicates Microsoft’s Spanish-language sign-in page. The domain is engineered to deceive users into entering sensitive account details, potentially leading to unauthorized access or credential theft. Infrastructure analysis reveals the domain sguridadvalidaraccsoffcwtpp.iceiy.com resolves to the IP address 185.27.134.141, hosted by I FastNet LTD in the United Kingdom. The domain was registered on December 06, 2020, through Porkbun LLC, a registrar frequently associated with low-reputation or malicious domains. Security vendors on VirusTotal flag the domain with 20 out of 95 detections, indicating moderate to high confidence in its malicious nature. The domain appears on at least one security blocklist, and additional monitoring services have classified it as active and harmful. The combination of brand impersonation, low vendor trust scores, and persistent activity elevates the risk profile. Mitigation against this brand impersonation threat requires a multi-layered approach. Users and organizations should block the domain and its resolving IP (185.27.134.141) at the network perimeter to prevent access. Security teams are advised to deploy indicators of compromise (IOCs) into endpoint protection and email filtering systems to detect and quarantine related phishing attempts. End-users should be trained to verify domain authenticity before entering credentials, particularly on pages requesting Microsoft account details. Domain registrars and hosting providers should be notified of the malicious infrastructure to facilitate takedown procedures. Continuous monitoring for similar impersonation domains using the seed '7c35cc' is recommended to identify related threats.