lagon[.]finance

The domain lagon.finance was registered on 2025-12-03 through Dynadot Inc. It resolves to the IPv4 address 188.114.96.3, which is hosted within the Amazon.com, Inc. network (AS16509) in the United States. DNS resolution uses the authoritative name servers ns1.dyna-ns.net and ns2.dyna-ns.net, and traffic is fronted by Cloudflare with HTTP/3 support. Web requests receive an HTTP 301 redirect and present a page titled “Even geduld…”. The site serves a valid Let's Encrypt certificate (YR1) and is reachable over HTTPS. VirusTotal analysis shows that 12 out of 95 scanned security vendors flag the domain as malicious, and it appears on two external blocklists, including PhishDestroy and BLP‑Malware. The Gridinsoft trust score is 0/100, reinforcing the malicious assessment. Current intelligence classifies the content as a generic phishing campaign, but the exact credential‑harvesting vector has not been publicly captured. No malware samples or payload URLs have been disclosed, leaving the precise lures and targeted brands uncertain. The presence of Cloudflare may obscure backend hosting details, and the redirect behavior could be used to forward victims to a hidden form. Defenders should treat lagon.finance as a high‑risk indicator. Immediate actions include adding the domain and its resolving IP address to outbound and inbound deny lists, updating DNS filtering rules, and ensuring that any email gateway that references the domain is blocked. Continuous monitoring of the IP range for new subdomains or similar redirects is recommended, as the operator may reuse the same infrastructure for future campaigns.