getsupport-find-device[.]click

Analysis indicates that the domain getsupport-find-device.click was registered on 17 February 2026 through Sav.com, LLC and uses the DNS servers dns1.dnspremium.pro and dns2.dnspremium.pro. The sole MX record points to the domain itself, which is atypical for a legitimate mail infrastructure and suggests a placeholder configuration. The domain resolves to the IPv4 address 50.6.199.153, an address owned by Oracle Corporation in the United States; the hosting provider appears to be a generic cloud service rather than a dedicated phishing‑hosting platform. No TLS certificate is presented, and the web server identifies itself as Apache HTTP Server. The only page retrieved before the site was taken offline returned the title “Access Denied”, providing no functional content for further content analysis.

Reputation services assign a Gridinsoft trust score of 0 / 100, effectively flagging the domain as malicious. VirusTotal reports that 15 of 94 scanned security vendors classified the domain as malicious, reinforcing the suspicion. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy feed, confirming its inclusion in known phishing mitigation sources. The overall risk rating is elevated, and the classification as a “Tech Support Scam” aligns with the observed infrastructure pattern where attackers commonly use generic technical‑support language to lure victims. Uncertainty remains regarding the exact payload or social‑engineering tactics employed, as the site was offline before any landing page could be captured.

No additional indicators such as malicious scripts, credential‑harvesting forms, or redirect URLs are available. Defenders should therefore prioritize blocking the domain at the DNS and proxy layers, add the associated IP address to network‑level deny lists, and monitor for any future re‑registration of the same second‑level name.