help-centre[.]support-2fa[.]com

The domain help-centre.support-2fa.com was registered on 22 March 2026 through Cloudflare, Inc. It resolves to the Cloudflare‑owned address 188.114.96.3, which is geolocated to Canada and is served behind Cloudflare’s network using HTTP/3. The TLS certificate presented is issued by Let’s Encrypt (E7) and the authoritative name servers are stevie.ns.cloudflare.com and zac.ns.cloudflare.com. When queried, the web server returns HTTP 403, indicating that access to the site is currently forbidden. VirusTotal analysis shows that 11 of 94 scanning engines have flagged the domain as malicious, and the domain is listed on a single external blocklist.

PhishDestroy has also taken the domain offline, and current threat‑intel status marks it as offline. The observed activity has been classified as a “Tech Support Scam”, a common social‑engineering vector where victims are contacted and coerced into providing credentials or payment. The elevated risk rating reflects the presence of multiple vendor detections and the use of a reputable CDN to obscure the true hosting infrastructure.

At present, the exact payload, landing page content, or targeted victims are not publicly disclosed, and no additional indicators such as malware hashes or command‑and‑control endpoints have been released. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any future re‑hosting, and add the domain to internal allow‑lists of known malicious sites. Continuous re‑evaluation is recommended in case the site is re‑activated or new intelligence emerges.