sud-chaqiruvi[.]help

PhishDestroy identifies sud-chaqiruvi.help as an active credential-harvesting phishing site deployed to steal user login credentials. The domain exhibits hallmark traits of a live campaign designed to harvest credentials under false pretenses, posing an elevated risk to unsuspecting visitors. Observed activity indicates it is currently in use and not a historical artifact.

This domain was flagged on April 5, 2026, with only 1 out of 95 VirusTotal security vendors detecting malicious activity at time of scan. The domain is registered via Global Domain Group LLC through an opaque structure often associated with short-lived malicious domains. It resolves to IP 104.21.83.209 and holds a valid Let’s Encrypt SSL certificate—common tactics to build trust and evade browser warnings. No current inclusion on major blocklists (e.g., Spamhaus, SURBL, PhishTank) was detected at analysis, though this is typical for newly activated domains. The combination of young age, low detection ratio, and reliance on a trusted registrar and SSL issuer suggests an early-stage, stealthy operation likely targeting specific user bases.

Mitigation for credential-harvesting attacks requires rapid domain blocking at the network and DNS level. Organizations should immediately block sud-chaqiruvi.help and its resolving IP (104.21.83.209) in firewalls and web filters. Users should be warned not to enter any credentials into this domain. Password reuse across services should be discouraged, and multi-factor authentication enabled wherever possible to limit damage if credentials are compromised. Security teams are advised to monitor for downstream phishing emails referencing this domain or its IP infrastructure. Proactive takedown requests should be filed with the hosting provider and domain registrar, referencing the low detection ratio to expedite action.