getsupport-alert-location[.]click

This domain is classified as an elevated-risk credential harvesting phishing site. Analysis indicates it was designed to mimic legitimate support portals, tricking users into submitting sensitive login credentials or personal information under false pretenses. The infrastructure exhibits characteristics consistent with large-scale phishing campaigns, including the absence of security controls and rapid takedown response. Infrastructure analysis reveals the domain getsupport-alert-location.click was registered on March 24, 2026, through Sav.com, LLC. It resolves to the IP address 50.6.199.153, hosted on Oracle Corporation infrastructure in the United States. The domain currently lacks an SSL certificate, increasing exposure to interception risks. Security vendor detection on VirusTotal stands at 20 out of 95, with one confirmed appearance on a security blocklist. The domain was subsequently blocked by network protection systems and taken offline following detection. Organizations should implement the following mitigation measures specific to credential harvesting threats. First, ensure all users are trained to recognize phishing indicators, such as unencrypted connections (HTTP), suspicious domain names, and unsolicited requests for credentials. Second, deploy email and web filtering rules to block domains registered through high-risk registrars or those lacking SSL certificates. Third, monitor network traffic for connections to known phishing IPs, such as 50.6.199.153, and investigate any outbound attempts to recently created domains. Finally, enforce multi-factor authentication to reduce the impact of credential theft.