login-tlo[.]com

This domain, login-tlo.com, is identified as a credential phishing site specifically designed to impersonate the TLOxp login portal. The domain is currently offline, but prior analysis confirms its malicious intent to harvest user credentials through a fraudulent login interface. The page title, 'TLOxp - Login,' directly mimics the legitimate service, increasing the likelihood of successful deception. Analysis of the domain reveals multiple high-risk indicators. It was registered through OwnRegistrar, Inc. on April 27, 2026, and resolves to the IP address 193.24.123.124, hosted by Prospero OOO in Russia. The domain appears on three security blocklists and is flagged by 18 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt (R12), a common tactic to lend false legitimacy to phishing sites. Infrastructure analysis indicates the domain was actively blocked by multiple threat intelligence feeds prior to being taken offline. The current status of login-tlo.com is offline, but the threat remains relevant due to its recent activity and high-risk classification. Organizations and users are advised to block the domain and its associated IP address (193.24.123.124) at the network level. Security teams should monitor for any resurgence of the domain or similar impersonation attempts targeting TLOxp or related services. End-users should be educated on recognizing phishing attempts, particularly those mimicking login portals, and encouraged to verify domain authenticity before entering credentials. Logs from April 27, 2026, onward should be reviewed for any interactions with this domain or its IP address.