lyonk[.]com

Lyonk.com, a phishing domain, was detected early in its lifecycle. Despite having zero detections on VirusTotal, it has been added to the PhishDestroy blocklist. The domain is currently offline, minimizing its immediate threat. This early detection highlights the gap between domain registration and antivirus database updates, a window often exploited by threat actors.

Registered through Cloudflare, Inc., lyonk.com was hosted on an IP in Canada, under CloudFlare's organization. The site used an SSL certificate issued by Google Trust Services, indicating an attempt to appear legitimate. The page title, 'ليونك LYONK,' suggests a potential targeting of Arabic-speaking users, although the specific brand or operation remains unclear.

PhishDestroy's proactive detection pipeline captures threats like lyonk.com before they propagate to antivirus vendors. This capability is crucial in mitigating risks during the vulnerable period immediately following domain registration. By listing the domain on public blocklists, PhishDestroy helps protect users from potential phishing attacks that exploit this early window.