Login page hosted at 196.251.113.41

Simulating a page served from a raw IP address (no domain). Real detection checks the current hostname.

Mentions in page: Please visit http://196.251.113.41/login to verify your account.

Download update from: http://185.180.143.22/security-patch.exe