mx2026mail[.]iceiy[.]com

This domain is flagged as part of a generic phishing campaign designed to harvest webmail credentials through fraudulent login portals. Analysis indicates the threat type is credential theft, with no evidence of malware distribution or crypto-draining functionality at this time. The risk level is classified as elevated due to the domain's recent creation, active impersonation of legitimate services, and detection by multiple security vendors. Infrastructure analysis reveals the domain mx2026mail.iceiy.com was registered on May 18, 2026, through Porkbun LLC, a registrar frequently utilized in low-sophistication phishing operations. The domain resolved to the IP address 185.27.134.130, geolocated in the United Kingdom under the provider I FastNet LTD. At the time of assessment, 20 out of 95 security vendors on VirusTotal had flagged the domain as malicious, while it appeared on one additional security blocklist. The SSL certificate was issued by ZeroSSL, a common choice for threat actors due to its free and automated issuance process. The domain has since been taken offline, though historical resolution data confirms its prior operational status. Mitigation against this type of credential harvesting threat requires multi-layered defenses. Network-level protections should include blocking the IP 185.27.134.130 and any domains registered through Porkbun LLC exhibiting similar naming patterns or creation timestamps. Endpoint security measures must prioritize real-time detection of phishing pages, particularly those mimicking webmail interfaces. User awareness training should emphasize the risks of entering credentials on unfamiliar login portals, even when domains appear superficially legitimate. Organizations are advised to implement multi-factor authentication to mitigate the impact of credential compromise, as well as monitor for anomalous authentication attempts originating from known phishing infrastructure.