ipicsou7[.]useruno[.]com

Analysis of ipicsou7.useruno.com shows a high‑risk credential‑phishing operation targeting Royal Mail customers. The site was registered through OVH SAS on 27 January 2025 and remains active as of 23 July 2026. DNS resolution points to 85.194.241.33, an address located in Poland and assigned to AS57367 Atman Sp. z o.o. The hosting server reports Nginx as the web server, and HTTP requests return a 403 status code, indicating restricted access to the underlying content.

The presented page title, "Log in | Royal Mail", aligns with the declared brand target and confirms the impersonation intent. Security‑vendor scanning on VirusTotal recorded 15 detections out of 93 scanners, and the domain appears on a single external blocklist. Gridinsoft assigns a trust score of 0 / 100, and PhishDestroy has already blocked the domain. The SSL certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, showing a valid TLS layer but offering no mitigation against the credential‑phishing payload. Email infrastructure is configured with an MX record pointing to mail1.hostuno.com (priority 10), and authoritative name servers dns1.hostuno.com and dns2.hostuno.com resolve the domain.

No additional evidence regarding the page content or malicious payload has been published, so the exact phishing mechanism remains unverified beyond the title and branding cues. Defenders should block connections to 85.194.241.33 and to the domain ipicsou7.useruno.com at the DNS level, enforce TLS inspection to capture the certificate details, and monitor for outbound traffic to the identified mail server. Email filtering rules should be updated to flag any messages claiming to originate from Royal Mail that reference the "Log in | Royal Mail" subject line. Continuous re‑scanning on multi‑vendor platforms is advised to capture any changes in detection rates.