auth[.]esport-ecups[.]com

Analysis of auth.esport-ecups.com, observed as a delivery‑scam vector, shows the domain was registered on 21 February 2026 and subsequently resolved to the Cloudflare address 104.21.32.1, which is announced by AS13335 in the United States. The SSL certificate presented for the site is identified as “WE1”, indicating a publicly‑trusted TLS certificate but providing no indication of legitimate ownership. Reputation services flag the domain: it appears on one known security blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal scans returned two positive detections out of ninety‑three scanners, reinforcing the suspicion of malicious use.

Independent scoring systems rate the site at the lowest possible level, with Gridinsoft assigning a trust score of 0 out of 100. The domain’s current HTTP status is offline, and the indicator “Status: taken offline” suggests that the hosting has been disrupted or the operator has ceased activity. Despite the offline state, the infrastructure footprint remains relevant because the underlying IP belongs to Cloudflare, a shared hosting provider frequently abused for fast‑flux and delivery‑scam campaigns.

Defenders should continue to block the domain at the DNS and proxy layers, monitor for re‑appearance of the same FQDN or its sub‑domains, and consider adding the associated IP address 104.21.32.1 to threat‑intel watchlists, especially if other malicious payloads are observed from the same address range. Ongoing correlation with external feeds such as PhishDestroy and VirusTotal will help detect any resurgence. At present, the limited detection (two vendors) and the offline status limit the ability to attribute a specific payload or campaign, so analysts should treat the domain as a high‑confidence indicator of a delivery‑scam infrastructure that may be re‑used by the same threat actors.