getsupport-device[.]info

This domain, getsupport-device.info, is flagged as a generic phishing threat with an elevated risk level. Analysis indicates it operates as a fake technical support portal, likely designed to deceive users into divulging credentials or installing malicious payloads under the pretext of resolving access errors. The page title 'Access Denied' suggests an attempt to mimic legitimate service blockades, a common social engineering tactic to induce urgency and compliance. Infrastructure analysis reveals the domain was registered on February 17, 2026, through Sav.com, LLC, an unusual future date that may indicate domain squatting or preemptive malicious registration. It resolves to IP address 50.6.199.153, hosted by Oracle Corporation in the United States. The SSL certificate is issued by Let's Encrypt (R12), a detail often exploited by threat actors to lend superficial legitimacy. VirusTotal detection shows 17 out of 95 security vendors have flagged the domain, while it appears on one security blocklist and is currently blocked by PhishDestroy. The domain status is offline, though this does not preclude future reactivation. Mitigation requires immediate blocking of the domain and its associated IP (50.6.199.153) at the network perimeter. Security teams should monitor for outbound connections to this IP or DNS queries for getsupport-device.info, particularly from endpoints exhibiting anomalous behavior such as unexpected credential prompts or unsolicited 'Access Denied' messages. End-user education should emphasize the risks of interacting with unsolicited support portals, especially those displaying generic error messages. Logs should be reviewed for prior connections to this domain, and any credentials potentially exposed should be invalidated and rotated. Given the domain's creation date discrepancy, organizations should also audit domain registration feeds for similarly anomalous future-dated entries.