support[.]suryagharyojna[.]com

PhishDestroy identifies support.suryagharyojna.com as an ACTIVE generic phishing domain hosting a credential-harvesting trap designed to impersonate a legitimate support portal. The site lures victims under the guise of technical assistance to steal login credentials, banking details, or other sensitive data. Given the absence of current blocklist detections and the use of a freshly issued SSL certificate via Let's Encrypt, this campaign exhibits high operational stealth. Users who access this domain risk immediate credential compromise and downstream financial fraud due to the realistic look of the fake login interface. PhishDestroy categorizes this as an active, ongoing threat requiring immediate user caution and network-level mitigation.

This domain was flagged by PhishDestroy seed #29da72 as a confirmed phishing site targeting unsuspecting users. The infrastructure analysis reveals the domain points to IP address 185.149.120.183 and was created on February 19, 2024, indicating a very recent registration intended to evade historical reputation filters. The domain is registered through GoDaddy.com, LLC using a privacy-protected registrant to obscure ownership, which is common in malicious campaigns. As of the latest VirusTotal scan, support.suryagharyojna.com shows 0 detections out of 95 engines, demonstrating zero detection by major AV suites at time of forensic capture. The Let's Encrypt SSL certificate provides a false sense of legitimacy but offers no real security benefit, as the certificate is only used to mask traffic as HTTPS and avoid browser warnings. Despite its current clean status on public threat feeds, the absence of domain age, lack of historical trust, and real-time activity strongly suggest this is an emergent credential-phishing campaign.

To mitigate the credential theft risk posed by support.suryagharyojna.com, PhishDestroy recommends users verify any unsolicited login prompts by manually typing known, trusted URLs and enabling multi-factor authentication (MFA) on all accounts. Network administrators should implement DNS sinkholing or domain blocking at the firewall level using the IP address 185.149.120.183 and domain name support.suryagharyojna.com to prevent internal access. If credentials were entered, victims should immediately reset passwords across all accounts using the same login, revoke active sessions, and monitor for unauthorized transactions. Given the domain’s recent creation and zero detection rate, it is likely already propagating via phishing emails purporting to be from tech support. Immediate user education and proactive blocking are critical to contain this campaign before it gains wider traction.