tt-verification-form[.]d2g[.]com

This domain, tt-verification-form.d2g.com, is flagged as an active fake login portal designed to harvest user credentials. Analysis indicates the site mimics legitimate authentication interfaces to deceive victims into submitting sensitive information, including usernames, passwords, and potentially multi-factor authentication codes. The domain remains operational, posing a high risk to individuals and organizations unaware of its malicious intent. Infrastructure analysis reveals the domain was registered on April 29, 1999, through Register.com, Inc., though the subdomain tt-verification-form.d2g.com appears to have been recently repurposed for phishing. It resolves to the IP address 13.62.48.175 and is hosted on an Nginx server. The page title, Plesk Obsidian 18.0.79, suggests an attempt to mimic a legitimate control panel interface, further enhancing the deception. The domain is flagged by 18 of 95 security vendors on VirusTotal, with additional blocklist entries confirming its malicious classification. The SSL certificate, issued by Let's Encrypt, provides a false sense of security while failing to mitigate the underlying threat. Current status confirms the domain remains active and accessible, continuing to serve phishing content. Organizations and individuals are advised to block the domain and its associated IP address (13.62.48.175) at the network level. Endpoint protection solutions should be updated to include this domain in their deny lists. Users who may have interacted with the site should immediately reset credentials for any accounts entered and monitor for unauthorized access. Security teams are encouraged to review logs for connections to the domain or IP address and investigate potential compromise.