support-idcase[.]com

support-idcase.com is currently offline but was observed delivering a tech support scam. The domain resolves to the IP address 50.6.199.153, which is geolocated to the United States and associated with Oracle Corporation infrastructure. Registration data shows the domain was created on 30 October 2025 and was registered through Sav.com, LLC. Authoritative nameservers dns1.dnspremium.pro and dns2.dnspremium.pro are listed in the DNS configuration. HTTP requests to the host return a page titled “Access Denied” served by Apache HTTP Server, and the site does not present an SSL certificate.

Reputation services assign the domain a low trust rating, with Scamadviser scoring 11 out of 100 and Gridinsoft reporting 0 out of 100. The domain appears on a single security blocklist and is specifically blocked by the PhishDestroy feed. VirusTotal analysis shows that 15 of 94 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of phishing activity.

No evidence of safe browsing or other mitigation services is present. Given the technical indicators – non‑encrypted HTTP service, low reputation scores, presence on a phishing blocklist, and multiple vendor detections – security operators should deny any network traffic to 50.6.199.153 and to support-idcase.com, add the domain to internal blocklists, and monitor DNS queries for future resolution attempts. Continuous observation of the hosting provider and registrar may reveal re‑use of the infrastructure in subsequent campaigns.