actionverification3641[.]iceiy[.]com

This domain, actionverification3641.iceiy.com, operates as a credential theft infrastructure designed to harvest login credentials through fraudulent verification portals. Analysis indicates the site mimics legitimate authentication flows, likely targeting users of financial services, email providers, or corporate access gateways. The threat actor behind this domain employs social engineering tactics to trick victims into entering sensitive information, which is then exfiltrated to attacker-controlled servers for unauthorized access or account takeover purposes. Infrastructure analysis reveals multiple indicators of malicious activity. The domain was registered on April 16, 2026, through Porkbun LLC, and resolves to the IP address 185.27.134.127, hosted in Great Britain under I FastNet LTD. Security vendors on VirusTotal flagged the domain as malicious, with 12 out of 95 engines detecting it. Additionally, the domain appears on one security blocklist and is currently offline, displaying a 'Domain Suspended' page title. The SSL certificate is issued by ZeroSSL, a common choice for both legitimate and malicious domains due to its free and automated issuance process. Users who visited actionverification3641.iceiy.com should take immediate action to mitigate potential risks. If credentials were entered on the site, reset passwords for all accounts where the same or similar credentials were used, prioritizing financial, email, and work-related services. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized activity, such as unfamiliar transactions or login attempts, and report any suspicious behavior to the respective service providers. Additionally, consider running a full antivirus scan to detect any secondary infections that may have been introduced through the phishing page.