lockervalue[.]info

PhishDestroy identifies lockervalue.info as an active credential theft phishing domain currently under investigation by threat intelligence teams. The domain is leveraging deceptive branding to harvest user login credentials, posing immediate risks to individuals and organizations who may interact with its fraudulent login portals. Current evidence suggests this infrastructure is designed to mimic trusted services, enabling attackers to capture sensitive authentication details for subsequent account takeovers and fraudulent activities. lockervalue.info was registered on March 22, 2026, through Global Domain Group LLC, a registrar facilitating high volumes of anonymized domain registrations. The domain resolves to IP address 188.114.97.3, which is hosted on infrastructure historically associated with low trust scores and minimal security monitoring. Notably, VirusTotal currently displays 0 detections from 95 vendor engines, indicating this campaign remains under the radar. The domain utilizes a Let’s Encrypt SSL certificate, enhancing its appearance of legitimacy while obscuring malicious intent. As of this report, lockervalue.info has not been widely blocked, raising the likelihood of continued exploitation against unsuspecting users. The current status of this threat remains active, with no confirmed takedown or widespread blocklisting at this time. Technical indicators include the domain’s recent creation, lack of historical reputation, and association with an IP known for hosting low-trust domains. Risk assessment places this campaign at an elevated level due to its credential theft objective and potential to escalate into broader fraud operations. Organizations and individuals are strongly advised to immediately block lockervalue.info and its associated IP (188.114.97.3) at the network and DNS levels. Users should verify all login URLs and avoid entering credentials on untrusted domains. Threat intelligence teams are urged to monitor for related infrastructure and share IOCs to preempt further exploitation. Updates will be provided as the investigation progresses.