validar-datos-365[.]iceiy[.]com

This domain, validar-datos-365.iceiy.com, is flagged as a credential theft operation targeting Microsoft 365 users. Analysis indicates the infrastructure was designed to mimic legitimate Microsoft authentication portals, likely harvesting corporate login credentials through fake verification prompts. No direct association with known crypto drainer kits or brand impersonation frameworks was observed, but the domain's naming convention and SSL certificate patterns align with credential harvesting campaigns. Infrastructure analysis reveals the domain was registered through Porkbun LLC on April 22, 2026, and resolved to the IP address 185.27.134.65, hosted by a provider in Great Britain. VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The SSL certificate was issued by ZeroSSL, a common choice for threat actors due to its low-cost and automated issuance process. No Google Safe Browsing detections were recorded at the time of analysis. The domain is currently offline, likely taken down following detection by PhishDestroy. While the immediate threat has been mitigated, residual risk remains for organizations that may have cached DNS records or employees who interacted with the domain prior to takedown. Network defenders are advised to monitor for authentication attempts from the IP 185.27.134.65 and review logs for connections to validar-datos-365.iceiy.com. Blocking the domain and associated IP at perimeter defenses is recommended as a precautionary measure.