account[.]remote-otp[.]com

The domain account.remote-otp.com is currently active and classified as a credential phishing site. Registration occurred on May 21, 2026 through Tucows Domains Inc., and the domain resolves to the IPv4 address 52.17.82.5, an AWS EC2 instance located in the Ireland (eu-west-1) region. DNS resolution is provided by four authoritative name servers: dns.technorail.com, dns2.technorail.com, dns3.arubadns.net, and dns4.arubadn. The site presents a valid SSL certificate issued by Sectigo Limited under the Sectio Public Server Authentication CA DV R36 chain, indicating the use of a publicly trusted certificate. HTTP requests return a 200 status code, suggesting the presence of a reachable web service. Reputation data shows a Gridinsoft trust score of 0/100 and the domain appears on a single security blocklist. VirusTotal analysis reports that 10 of 91 security vendors have flagged the domain, reinforcing the phishing assessment. The domain has been blocked by PhishDestroy, yet it remains operational. While the exact phishing page content has not been examined, the available indicators confirm malicious intent targeting credential collection. Defenders should block DNS resolution and HTTP(S) traffic to the domain, monitor for any outbound connections to the associated IP address, and update detection rules to include the listed name servers and SSL fingerprint. Continuous re‑evaluation is advised, as additional infrastructure or payload details may emerge.