user-suppot[.]accounts-admin-agency[.]com

PhishDestroy identifies user-suppot.accounts-admin-agency.com as an active credential phishing domain designed to trick users into submitting sensitive login credentials. The domain employs a spoofed account-support interface, likely targeting users of financial or administrative services by impersonating a legitimate agency. No evidence suggests the use of a crypto drainer kit or advanced malware delivery; instead, the threat relies on social engineering and impersonation to harvest usernames and passwords. The domain's structure mirrors official portals but features subtle misspellings (e.g., 'suppot' instead of 'support') to evade initial scrutiny and lure victims into a false sense of security.

Technical forensic analysis reveals several alarming indicators confirming this domain's malicious intent. Registered through Gransy, s.r.o., on May 01, 2026, the domain resolves to IP address 162.159.140.98. Its SSL certificate is issued by Google Trust Services, which may lend an air of legitimacy, though certificates can be abused by threat actors to appear trustworthy. VirusTotal flags the domain with a detection score of 21 out of 95 security vendors, indicating partial but not universal recognition of its malicious nature. Additionally, the domain appears on one known security blocklist and is actively distributing a credential phishing payload. These technical markers collectively highlight a well-orchestrated but opportunistic attack infrastructure, leveraging recently registered domains and trusted certificate authorities to maximize its reach.

As of the latest assessment, user-suppot.accounts-admin-agency.com remains active and poses an elevated risk to unsuspecting users. It has been flagged and blocked by security entities such as PhishingArmy, though its continued availability suggests gaps in global threat intelligence sharing. Immediate actions include deactivating the domain at the registrar level and updating browser-based blocklists to prevent further victimization. Remaining risk is classified as elevated due to the domain's recent creation, partial detection rates, and reliance on user error rather than sophisticated exploit techniques. Users are strongly advised to verify the legitimacy of any login portals—especially those accessed via unsolicited emails or links—and to utilize services like PhishDestroy for real-time threat validation before entering credentials.