lbanksecure[.]com

The domain lbanksecure.com was observed in a phishing campaign targeting users of the LBank platform. The domain was registered on July 5, 2025 through GoDaddy.com, LLC. DNS resolution points to the IPv4 address 134.209.109.158, which belongs to the DigitalOcean, LLC network (AS14061) located in Singapore. The HTTP response returned the page title “LBank”, confirming the intended brand reference. An SSL certificate with an E6 rating was present at the time of analysis, indicating a low trust level. Independent scanning on VirusTotal recorded eight detections out of ninety‑five antivirus engines, reinforcing the malicious classification.

Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole service. Current network probes show the host is offline, consistent with the reported takedown status. Evidence suggests the infrastructure relies on a generic cloud provider, which is a common pattern for short‑lived phishing sites.

No additional artifacts such as malware payloads, command‑and‑control endpoints, or credential‑harvesting URLs have been disclosed. Defenders should add 134.209.109.158 and lbanksecure.com to outbound and inbound filtering rules, monitor for newly registered domains with similar naming patterns, and ensure that endpoint protection solutions are updated to reflect the eight VirusTotal detections. Continuous observation of GoDaddy‑registered domains pointing to DigitalOcean AS14061 is advisable, as the provider has been repeatedly leveraged for phishing operations. Until further activity is observed, the domain can be considered mitigated.