activarcuernta[.]iceiy[.]com

This domain, activarcuernta.iceiy.com, is identified as a credential theft operation designed to harvest user login credentials through fraudulent web forms. Analysis indicates no direct association with a specific brand or drainer kit, but the infrastructure aligns with common phishing tactics targeting financial or corporate account access. The domain employs social engineering techniques, such as fake login prompts, to trick users into submitting sensitive information. Infrastructure analysis reveals the domain was registered through Porkbun LLC and resolves to the IP address 185.27.134.141, hosted by I FastNet LTD in the United Kingdom. The domain was created on April 16, 2026, and is currently flagged by 9 out of 95 security vendors on VirusTotal. It appears on one security blocklist and was previously blocked by additional detection systems. The SSL certificate is issued by ZeroSSL, a common provider for both legitimate and malicious domains, which does not mitigate the threat. As of the latest assessment, activarcuernta.iceiy.com has been taken offline, reducing immediate exposure. However, residual risk remains due to potential reuse of the infrastructure or registration of similar domains. Organizations are advised to monitor for related indicators, including the IP address 185.27.134.141 and the registrar Porkbun LLC, in network logs. Users should verify domain authenticity before entering credentials and report any suspicious activity to their security teams.