correos-institucionallco2026x[.]iceiy[.]com

This domain, correos-institucionallco2026x.iceiy.com, is actively impersonating Microsoft login pages as of July 12, 2026. Analysis indicates the site presents a page titled 'Iniciar sesión en tu cuenta Microsoft,' directly targeting Spanish-speaking users of Microsoft services. The domain was registered through Porkbun LLC and is hosted on infrastructure associated with AS34119 (Wildcard UK Limited), resolving to IP address 185.27.134.98. Nameserver records point to ns1.byet.org through ns5.byet.org, a configuration commonly observed in low-cost or abused hosting environments. Technical indicators reveal the use of Nginx with OpenResty, alongside jQuery and Google Hosted Libraries, suggesting a relatively standard web stack with no immediately unique fingerprint. The SSL certificate is issued by ZeroSSL GmbH under the ZeroSSL ECC DV SSL CA 2 intermediate, a common choice for both legitimate and malicious domains. The domain was created on December 6, 2020, and has been flagged by at least two security blocklists, including PhishDestroy and Phishunt. Five of 91 security vendors on VirusTotal have detected this domain as malicious, though this detection rate is not conclusive evidence of widespread recognition. Defenders should treat this domain as high-risk due to its active brand impersonation of Microsoft, confirmed page title, and presence on multiple blocklists. The infrastructure, while not inherently malicious, has been previously associated with phishing activity. Network-level blocking of 185.27.134.98 and domain-level blocking of correos-institucionallco2026x.iceiy.com are recommended. Additional monitoring of the byet.org nameserver cluster may reveal related phishing domains. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, active status, and blocklist presence justifies immediate defensive action.