test[.]vdi1[.]suryagharyojna[.]com

PhishDestroy identifies test.vdi1.suryagharyojna.com as an active phishing site masquerading as a legitimate payroll login portal, likely targeting victims through deceptive social-engineering campaigns. This domain leverages a legitimate SSL certificate from Let's Encrypt to appear trustworthy, but its infrastructure raises significant red flags. Research shows this malicious host resolves to IP 185.149.120.183 and has been flagged by only one out of 95 VirusTotal security vendors, suggesting limited early detection but not detracting from its active threat status. This domain was registered via GoDaddy.com, LLC on February 19, 2024—a recent creation designed for short-lived malicious use. While only a single antivirus engine currently detects it, such domains often evade detection until widespread abuse is reported. Its swift deployment and plausible naming (suryagharyojna referencing a government scheme) aim to trick users into entering sensitive credentials under false pretenses. Users who have accessed this domain should immediately check their login credentials for any exposure, enable multi-factor authentication on related accounts, and scan local devices for malware. Avoid entering any personal or financial details on this site. Report the domain to your security team or via trusted abuse channels to aid in broader takedown efforts. Proactive monitoring of network traffic for connections to 185.149.120.183 is strongly advised to prevent further compromise.