auth[.]aisupportcontentidentity[.]com

The domain auth.aisupportcontentidentity.com was registered on February 26, 2026 and is currently listed as offline. DNS resolution points to IP address 172.67.137.43, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The infrastructure choice of Cloudflare suggests the operator leveraged a reputable CDN to obscure the origin of the malicious activity. The site’s SSL certificate is identified as type E8, indicating a publicly trusted certificate that can lend legitimacy to phishing attempts.

Analysis of threat‑intel feeds shows the domain is associated with a tech support scam, a scheme that typically coerces victims into granting remote access or paying for bogus services. Nine of ninety‑three security vendors on VirusTotal have flagged the domain, providing a modest but notable detection ratio that aligns with the observed scam classification. The domain appears on one external blocklist and has been actively blocked by the PhishDestroy service, confirming that at least some protective platforms recognize it as malicious.

While the exact content of the website, including page title or any mimicked brand, has not been publicly disclosed, the available indicators—creation date, Cloudflare hosting, SSL profile, detection count, and blocklist presence—collectively support an elevated risk rating. Defenders should ensure the domain is added to network deny lists, monitor traffic to the associated Cloudflare IP for anomalous patterns, and employ endpoint protection that respects VirusTotal detection signals. Continuous re‑evaluation is advised in case the domain is re‑activated or the underlying IP is repurposed for further malicious campaigns.