isheaithcare[.]net

The domain isheaithcare.net was registered on 20 February 2025 through NameCheap, Inc. and currently resolves to the IPv4 address 45.61.134.163, which is announced by AS14956 RouterHosting LLC in the United States. The site is offline at the time of analysis and has been taken down by the PhishDestroy takedown service. Public blocklists show the domain listed on a single security blocklist, and three AlienVault OTX pulses reference it, indicating that it has been observed in multiple threat‑intel feeds. The page title returned from the HTTP response is “Security verification”, a common lure for credential‑stealing or verification‑type scams. The domain is associated with a Microsoft brand impersonation and is classified as a tech‑support scam, although the exact content of the page has not been captured for further examination.

VirusTotal reports that 17 of 95 scanning engines flag the domain as malicious, reinforcing the suspicion of abuse. The Gridinsoft trust score of 0 out of 100 further reflects a high confidence of malicious intent. No TLS certificate is present, meaning communications are unencrypted and can be intercepted or altered. The authoritative name servers are jim.ns.cloudflare.com and kim.ns.cloudflare.com, both operated by Cloudflare DNS.

Defenders should continue to block traffic to 45.61.134.163 and add isheaithcare.net to URL filtering policies. Monitoring for any resurgence of the domain or similar newly‑registered domains that target Microsoft users is recommended. Because the site currently returns no content, passive DNS and SSL monitoring can provide early warning if the operators re‑activate the domain with a valid certificate or new hosting. Incident response teams should treat any user reports of unsolicited Microsoft support calls linked to this domain as likely malicious and advise users to verify the authenticity of any support request through official Microsoft channels.