credi-reactivar-caso09383[.]iceiy[.]com

PhishDestroy identifies credi-reactivar-caso09383.iceiy.com as an active Credicard-branded credential harvesting domain categorized as generic phishing with an elevated risk rating. The site masquerades as a Credicard reactivation portal, coercing victims into surrendering online banking credentials, card numbers, and personally identifiable information under the pretense of unlocking a suspended account. This domain was flagged by 15 out of 95 VirusTotal security vendors, indicating limited but significant detection coverage. It resolves to IP 185.27.134.222 and was created on December 6, 2020, registered via Porkbun LLC using a ZeroSSL certificate to appear legitimate. The use of a subdomain under iceiy.com—a known dynamic DNS provider with historically weak abuse controls—further lowers trust. These indicators collectively suggest a coordinated phishing campaign likely automated for scale. To neutralize exposure, immediately block both the domain and IP at network and endpoint levels. Users who may have entered any information should revoke and reissue affected credit cards, reset online banking passwords using a separate device, and monitor accounts for unauthorized transactions. Report the domain to your CERT or abuse teams to accelerate takedown and strengthen collective defense against this Credicard-branded scam.