segurity-msn-adviser[.]iceiy[.]com

segurity-msn-adviser.iceiy.com was observed on July 12 2026 as an active Microsoft brand‑impersonation site. The domain is classified as a high‑risk, tech‑support phishing operation targeting users who may be prompted to log in or provide remote access credentials. Its registration date is December 6 2020 and it remains under the control of the same registrant.

The domain resolves to the IPv4 address 185.27.134.176, which is geolocated to the United Kingdom and belongs to AS34119 (Wildcard UK Limited). DNS resolution is served by the byet.org name server cluster (ns1.byet.org, ns2.byet.org, ns3.byet.org, ns4.byet.org, ns5.byet.org). The site presents a valid TLS certificate issued by ZeroSSL ECC Domain Secure Site CA, indicating the use of free SSL services to lend legitimacy.

HTTP requests to the host return status code 200, and the page title captured is “Iniciar Sesión                                           VerNzUxODg3NTY1ODQzOTc1”. VirusTotal analysis shows 11 of 95 security vendors flag the domain as malicious. The host appears on two public blocklists and is listed by PhishDestroy and PhishingDB. The technical evidence aligns with a tech‑support scam pattern, though the exact payload or credential‑stealing mechanisms have not been publicly disclosed.

Defenders should add segurity-msn-adviser.iceiy.com and its resolving IP 185.27.134.176 to network blocklists and sinkhole configurations. Monitoring of the byet.org name‑server range for sudden additions can provide early warning of similar campaigns. User awareness messages should emphasize that unsolicited Microsoft‑related support contacts are likely fraudulent, and that any request to log in via this domain should be rejected.