testtdomain[.]cfd

This domain, testtdomain.cfd, is identified as an active credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates the site mimics legitimate application portals, as suggested by the page title 'Lovable App,' to trick visitors into submitting sensitive credentials such as usernames, passwords, or multifactor authentication codes. The infrastructure is designed to appear authentic, leveraging content delivery networks and modern web protocols to evade initial scrutiny. Infrastructure analysis reveals multiple indicators of malicious intent. The domain was registered on June 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.164.254, which is part of a network known for hosting phishing infrastructure. Security vendor detections on VirusTotal report 6 out of 95 engines flagging the domain as malicious. Additionally, the domain appears on one security blocklist and is actively blocked by anti-phishing systems. The SSL certificate, issued by Google Trust Services, further obscures the site’s true nature by providing a false sense of security. Users who have visited testtdomain.cfd or entered credentials on the site should take immediate action to mitigate potential compromise. All submitted credentials should be considered exposed and must be changed across any platforms where they were reused. Affected individuals are advised to enable multifactor authentication on critical accounts and monitor for unauthorized access or transactions. System administrators should update network security policies to block the domain and its resolving IP address. If financial or personally identifiable information was entered, users should report the incident to relevant authorities and consider credit monitoring services to detect potential misuse.