getsupport-idcase84632[.]click

The domain getsupport-idcase84632.click was registered through Sav.com, LLC and first observed on February 17, 2026. Infrastructure analysis shows it resolves to the IPv4 address 50.6.199.153, an Oracle Corporation‑owned hosting block located in the United States. The host runs Apache HTTP Server and does not present an SSL/TLS certificate, meaning all traffic is served over plain HTTP. DNS resolution is provided by dns1.dnspremium.pro and dns2.dnspremium.pro. When queried, the only visible page element is the title “Access Denied”, indicating that the site is currently not serving content to the public.

Dynamic analysis on VirusTotal recorded 16 of 94 scanning engines flagging the domain as malicious, and the site appears on a single external blocklist. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. The domain has been classified as a “Tech Support Scam”, a social‑engineering vector that typically coerces victims into granting remote access or paying for fraudulent support services. The site has already been taken offline and is listed as blocked by the PhishDestroy remediation service.

Defenders should add the fully qualified domain name and the associated IP address 50.6.199.153 to network‑level deny lists, DNS sinkhole configurations, and endpoint protection rule sets. Continuous monitoring of the dnspremium.pro name servers is advised, as the operators may reuse the same infrastructure for future campaigns. Because the site lacks HTTPS, any attempted connections can be intercepted for additional intelligence, but caution is required to avoid contaminating internal networks. Logging of HTTP request attempts to this domain will aid in detecting compromised hosts that may have previously interacted with the service.