fortwofactorapp[.]lol

Fortwofactorapp.lol was registered through Dynadot LLC and created on 13 October 2025. The authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net resolve the domain to the IPv4 address 2.20.242.34, which is announced by AS6762 Telecom Italia Sparkle S.p.A. in Italy. No TLS certificate is presented for the host, indicating that the site was served over plain HTTP. The only visible page title returned during the last crawl was "Suche – Microsoft Bing", and the domain is explicitly associated with a Microsoft brand impersonation in the intelligence feed. The scam typology is listed as a "Tech Support Scam", suggesting that the site was likely used to lure victims into believing they required assistance with Microsoft products.

VirusTotal records show that 10 of 95 scanning engines flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat. The domain appears on a single security blocklist and has been blocked by the PhishDestroy takedown service. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100. As of the report date (23 July 2026) the site is reported offline, limiting current content analysis. Because the site no longer resolves, investigators cannot confirm whether a credential‑harvesting form or remote‑access tool was delivered. The absence of a TLS certificate also suggests that any credentials submitted would have been transmitted in clear text, increasing the potential impact.

The domain’s recent creation date (less than one year old) and use of a free‑tier registrar align with typical tactics used by opportunistic actors to quickly spin up impersonation sites. The presence of the page title referencing Microsoft Bing may have been intended to lend an appearance of legitimacy to search‑engine results.