getsupport-location[.]click

The domain getsupport-location.click is currently identified as a credential theft infrastructure designed to harvest user login credentials. Analysis indicates the domain is offline, though it previously hosted content that mimicked legitimate support portals to deceive users into submitting sensitive information. No specific brand impersonation has been confirmed, but the operational pattern aligns with credential harvesting campaigns targeting unsuspecting victims. Infrastructure analysis reveals the domain was registered through Sav.com, LLC on February 17, 2026, and resolved to the IP address 50.6.199.153. Security vendors flagged this domain in 11 of 95 VirusTotal scans, and it appears on at least one security blocklist. The site displayed an 'Access Denied' page title, which may have been a placeholder or an attempt to evade automated detection. No SSL certificate was present, further reducing its legitimacy and increasing exposure to interception risks. At present, getsupport-location.click is offline, though domains of this nature often resurface under different names or infrastructure. Users who may have interacted with this domain should immediately reset any credentials entered on the site and monitor accounts for unauthorized activity. Organizations are advised to block the domain and its associated IP in perimeter defenses, and to conduct retrospective log analysis for connections to 50.6.199.153. Security teams should treat this domain as part of a broader credential theft campaign and adjust detection rules accordingly.