authstep-x[.]com

Analysis of authstep-x.com, observed offline as of the report date, shows that the domain was registered on 23 February 2026 through HOSTINGER operations, UAB and is served by Hostinger’s DNS‑parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. The domain resolves to the IPv4 address 84.32.84.32, which belongs to AS47583 Hostinger International Limited located in Lithuania. No TLS certificate is presented, indicating that HTTPS connections are not supported. The HTTP response presents the generic title "Parked Domain name on Hostinger DNS system", confirming that the site is currently a parked landing page rather than an active phishing landing page.

Nevertheless, the domain is listed on three public phishing blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, suggesting that it was previously used for social media phishing campaigns. VirusTotal analysis records a single positive detection out of 93 scanned scanners, reinforcing the presence of malicious activity. The specific scam type is identified as "Social Media Phishing", though the exact target brand or lure details have not been disclosed.

Because the domain is offline, real‑time HTTP content cannot be examined, and the lack of SSL and the parked page title limit attribution of current payloads. Defenders should continue to block the IP address 84.32.84.32 at network perimeter, add authstep-x.com to URL filtering lists, monitor for re‑activation, and verify that any inbound traffic to the associated blocklist entries is denied. Ongoing watch of the registrar’s activity and periodic re‑scans with VirusTotal or similar services are recommended to capture any future changes in the domain’s behavior.