auth-id[.]css[.]register2564[.]org

Analysis of auth-id.css.register2564.org indicates that the domain was registered on November 17, 2021 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IPv4 address 27.254.145.131, which is announced by AS9891 (CS LOXINFO Public Company Limited) and geolocated to Thailand. The domain is presently offline, and no TLS certificate was observed, meaning any attempt to establish an encrypted session would fail. The sole page title returned from the HTTP response is “Domain Default page”, providing no further context about the content served. The site is classified as a brand‑impersonation campaign targeting the “base” brand, and it has been listed on at least one public phishing blocklist, specifically PhishDestroy.

VirusTotal reports that 12 of 95 security vendors have flagged the domain, reinforcing the malicious assessment. Reputation services assign extremely low trust scores: Scamadviser rates the domain 1/100 and Gridinsoft 0/100, reflecting a high likelihood of abuse. Nameservers th113.hostatom.com and th114.hostatom.com are associated with the hosting provider, but no additional infrastructure details are available.

Because the domain is already taken offline, active mitigation is limited; however, defenders should continue to block the domain at DNS and proxy layers, monitor for any resurrection or similar patterns in newly registered domains using the same registrar or hosting infrastructure, and update detection rules to incorporate the observed indicators such as the IP address 27.254.145.131, the registrar PDR Ltd., and the specific nameserver set. Uncertainty remains regarding the exact phishing landing page and whether credential‑harvesting kits were employed, as no page content was captured before the takedown. Ongoing vigilance is advised.