dc[.]crsorgi[.]gov[.]in[.]govaco[.]shop

PhishDestroy identifies dc.crsorgi.gov.in.govaco.shop as a live brand-impersonation scam that mimics the official Civil Registration System portal of the Government of India. The counterfeit site displays a page titled “Validate Certificate | Civil Registration System | Government of India” to trick visitors into submitting sensitive credentials under the false promise of verifying an SSL certificate. Once a victim enters data, the page is engineered to harvest usernames, passwords, or other personal details for follow-on identity theft or financial fraud, while the attacker can later drain linked accounts or resell the information on dark-web markets. Genuine CRS services always use the domain crsorgi.gov.in and never redirect through third-party domains; this impersonation is therefore designed solely to deceive users into surrendering trust-based information. This domain was flagged by PhishDestroy on 2024-05-25. Intelligence shows it registered through an anonymizing registrar on 2024-05-19, resolving to IP 157.90.176.32 with a Let’s Encrypt SSL certificate. Independent testing confirms detection by 20 of 95 VirusTotal security partners, and the page is blocked by OpenPhish, PhishingArmy, and Maltrail. Google Safe Browsing has already labeled the page as SOCIAL_ENGINEERING, indicating clear intent to deceive users rather than deliver legitimate content. The site remains active at the time of analysis, demonstrating an ongoing threat to Indian citizens seeking vital civil-registration services. If you visited dc.crsorgi.gov.in.govaco.shop, immediately stop and close the browser tab. Do not enter any government IDs, birth or marriage certificate numbers, or passwords. On another device you trust, run a full antivirus scan and change any reused passwords, starting with email and banking accounts. Report the incident to IndiaCERT (incident@cert-in.org.in) and file a complaint with the Cyber Crime Helpline at cybercrime.gov.in. Bookmark the genuine portal at crsorgi.gov.in and only navigate there via official channels to avoid similar traps in future.