audiodeficitmedia[.]com

Analysis indicates that the domain audiodeficitmedia.com was registered on August 29 2025 through Cosmotown, Inc. The authoritative nameservers dns1.anymhost.id, dns2.anymhost.id, dns3.anymhost.co.id, and dns4.anymhost.co.id resolve the domain to the IP address 163.223.227.36, which belongs to AS199695 PT Anym Network Indonesia and is geolocated in Indonesia. The site presented a WordPress stack with MySQL, PHP, Yoast SEO, jQuery, and HTTP/3 support, and responded with HTTP status code 500 at the time of observation. The TLS certificate was issued by Let’s Encrypt (R13), confirming the presence of HTTPS. The only visible page title was “Selamat Datang di AnymHost! Situs Anda Aktif.”, indicating a generic hosting landing page rather than a targeted login interface.

MX records are configured with priority 0 pointing to the domain itself, suggesting potential email abuse. The domain is flagged by PhishDestroy and appears on one external blocklist, and a Gridinsoft trust score of 0 out of 100 further signals malicious intent. VirusTotal recorded detections from 2 of 95 scanners, reinforcing the suspicion. The threat profile lists the campaign as a Tech Support Scam that impersonates Google, aligning with the brand target field.

Current status is offline, but historical activity implies that the infrastructure was used to lure victims with false technical support claims. Uncertainty remains regarding the exact payload delivered to victims, as no sample of the malicious content has been captured. Defenders should block the IP 163.223.227.36 and the domain at DNS level, monitor for any residual email traffic using the configured MX record, and continue to update detection signatures for the observed WordPress and PHP stack artifacts. Incident response teams should also consider checking for compromised credentials on any systems that may have interacted with the domain before it was taken offline.