# support-idcase.com — MALICIOUS > support-idcase.com hosts credential theft phishing targeting crypto users, flagged by 13 of 95 VirusTotal vendors. ## Summary PhishDestroy identifies support-idcase.com as an active crypto credential theft phishing domain targeting users with false identity verification claims. The domain is currently classified as an elevated threat and remains live at the time of this report. This domain was flagged by 13 of 95 VirusTotal security vendors, indicating significant malicious activity. It was registered through Sav.com, LLC on October 30, 2025, and resolves to IP address 50.6.199.153. The domain utilizes a Let's Encrypt SSL certificate to appear legitimate, while actively harvesting login credentials under the guise of identity verification. Support-idcase.com presents an active risk to cryptocurrency users through deceptive identity verification lures. Organizations and individuals are advised to block this domain at the network level, avoid accessing it, and monitor for any exposed credentials. Immediate implementation of DNS filtering and user awareness campaigns is recommended to prevent potential credential theft and associated financial losses. ## Threat Details - Verdict: MALICIOUS - Site status: unknown (HTTP ?) ## Domain Intelligence - Registered: 2025-10-30 00:50:18 - Registrar: Sav.com, LLC - IP: 50.6.199.153 ## Detection Status - VirusTotal: 13 vendors flagged - Google Safe Browsing: clean - Blocklists: 0 hits ## Evidence - Cloudflare Radar: https://radar.cloudflare.com/scan/6cb36fd2-66cb-4b19-a2bc-0c08237f4d7e - PhishDestroy: https://phishdestroy.io/domain/support-idcase.com/ - LLM endpoint: https://phishdestroy.io/domain/support-idcase.com/llm.txt ## If You Visited This Site 1. Change any passwords you may have entered 2. Enable 2FA on all related accounts 3. Monitor your accounts for unauthorized activity 4. Report to: FBI IC3, Europol, local authorities --- Report by PhishDestroy | https://phishdestroy.io/domain/support-idcase.com/ Last updated: 2026-03-23