contratolivmsn365acti[.]iceiy[.]com

Analysis of contratolivmsn365acti.iceiy.com indicates a brand impersonation campaign targeting Microsoft, classified as elevated risk credential theft. The domain structure mimics Microsoft 365-related terminology, suggesting intent to deceive users into entering authentication data under a fabricated service context. No active payload or drainer kit is observed in the captured state, and the page resolves to a generic “Home” title, indicating either a fallback template or partial takedown behavior.

Technical infrastructure analysis shows the domain was created on April 28, 2026 and registered through Porkbun LLC. It resolves to IP 185.27.134.225 located in GB under I FastNet LTD hosting. SSL is issued via ZeroSSL / ZeroSSL ECC Domain Secure Site CA, indicating automated certificate provisioning common in rapidly deployed phishing infrastructure. VirusTotal reports 22/95 security vendors flagging the domain, and it appears on 1 security blocklist with explicit blocking by PhishDestroy. No Google Safe Browsing status is provided in the dataset.

At the time of assessment, the domain is reported as taken offline, reducing immediate user exposure. However, the combination of high detection ratio (22/95), recent registration date, and Microsoft impersonation pattern indicates likely reuse potential in adjacent infrastructure. Continued monitoring of the associated IP 185.27.134.225 and related domains under iceiy.com subdomains is recommended, as attackers frequently rotate hosting while retaining similar credential-harvesting templates. Preventive measures should focus on domain blocking, email filtering rules, and user awareness for Microsoft login spoofing attempts.