logtourprtl[.]com

This domain is flagged as a high-risk fake alert phishing site designed to mimic legitimate security warnings. Analysis indicates the threat type involves deceptive pop-up messages labeled 'Important Message,' which are engineered to induce panic and trick users into disclosing sensitive credentials or downloading malicious payloads. The infrastructure exhibits multiple red flags consistent with phishing operations, including the absence of SSL encryption and a suspiciously recent creation date. Infrastructure analysis reveals the domain logtourprtl.com was registered through ENOM, INC. on October 26, 2025, and currently resolves to the IP address 104.37.86.70, hosted on AS54456 (CloudAccess.net, LLC) in the United States. The domain lacks an SSL certificate, a common characteristic of low-effort phishing sites. VirusTotal reports 19 out of 95 security vendors flagging this domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on at least one security blocklist, specifically PhishDestroy, and is currently offline, though historical activity remains a concern. Mitigation steps for this specific threat type include blocking the domain at the network perimeter and adding the IP address 104.37.86.70 to firewall deny lists. Organizations should conduct retrospective log analysis to identify any prior connections to this domain or IP, particularly from endpoints that may have accessed the 'Important Message' page. Users who encountered this domain should be instructed to reset credentials for any accounts accessed during the potential exposure window, with emphasis on email, financial, and single-sign-on services. Security teams should monitor for similar domains registered via ENOM with recent creation dates, no SSL, and comparable page titles to preemptively disrupt related campaigns.