loginsplug[.]ng

This domain, loginsplug.ng, is identified as an active credential phishing infrastructure designed to harvest user authentication credentials. Analysis indicates the site mimics legitimate login portals, presenting a high-risk threat to individuals and organizations by capturing sensitive access details. The domain remains operational as of the latest verification. Infrastructure analysis reveals loginsplug.ng was registered on December 24, 2023, through GO54 Limited, a registrar previously associated with Whogohost Limited. The domain resolves to the IP address 163.61.188.7 and employs a Let's Encrypt SSL certificate to create an appearance of legitimacy. Detection metrics show that 4 of 95 security vendors on VirusTotal have flagged the domain as malicious, reflecting moderate but concerning detection coverage. The page title, 'Loginsplug - Products,' suggests an attempt to disguise the phishing page as a commercial or service-oriented platform. Current status confirms the domain remains active, posing an ongoing threat to unsuspecting users. Organizations and individuals are advised to block access to 163.61.188.7 and loginsplug.ng at the network perimeter. Security teams should monitor for connections to this IP and domain, particularly from endpoints exhibiting anomalous authentication attempts. End-user education should emphasize verifying domain authenticity before entering credentials, especially when prompted by unsolicited login requests. Proactive measures, including the deployment of endpoint detection rules targeting this infrastructure, are recommended to mitigate exposure.