# PhishDestroy threat dossier — lion-trust.app ================================================================ Fetched: 2026-05-18 21:41:17 UTC Canonical: https://phishdestroy.io/domain/lion-trust.app/ ## VERDICT ---------------------------------------------------------------- ACTIVE THREAT — multiple warning signs Composite threat score: 51/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 15/95 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, ESET, Fortinet, G-Data, Kaspersky, LevelBlue, Lionic, Mimecast, SOCRadar, Sophos, VIPRE, Webroot URLQuery: 3 detections ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 151.158.1.161 Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: holly.ns.cloudflare.com, ned.ns.cloudflare.com Registered: 2026-05-15 Expires: 2027-05-15 Page title: Lion Trust HTTP response: 200 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-15 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-18 22:16:47 UTC (by PhishDestroy tracker) First reported: 2026-05-18 19:18:16 UTC (abuse notice filed) Last verified: 2026-05-18 23:15:04 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e3c83-88a9-769d-a6af-069d79ad7995/ URLQuery: https://urlquery.net/report/d32d4367-aab9-4754-b33d-dc048926ae87 Wayback Machine: https://web.archive.org/web/*/lion-trust.app crt.sh CT logs: https://crt.sh/?q=%25.lion-trust.app Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=lion-trust.app AlienVault OTX: https://otx.alienvault.com/indicator/domain/lion-trust.app URLhaus: https://urlhaus.abuse.ch/host/lion-trust.app/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-18 22:17:14 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies lion-trust.app as an active phishing domain designed to impersonate a legitimate investment or financial service, tricking visitors into surrendering sensitive credentials or payment details. The site leverages spoofed branding and urgent messaging to convince users of its authenticity, often mimicking well-known financial institutions or crypto platforms. Once credentials are entered, threat actors harvest them for fraudulent transactions, identity theft, or further phishing campaigns. This domain was flagged by 15 out of 95 security vendors on VirusTotal, indicating widespread suspicion within the threat intelligence community. It resolves to IP address 151.158.1.161 and holds an SSL certificate issued by DigiCert Inc, which threat actors often abuse to appear legitimate. The domain was registered on May 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk or malicious registrations. This domain poses an elevated risk due to its recent creation, low detection coverage, and deceptive branding strategy. Threat actors commonly register such domains in bulk and deploy them quickly to capitalize on current events, trending topics, or financial trends. The use of a valid SSL certificate further lowers user suspicion, making it easier to trick individuals into disclosing login credentials or financial information. Because the domain is still young, it may not yet appear on many blocklists, increasing the window of opportunity for attackers. The combination of low detection (15/95), recent registration date, and hosting on a dedicated IP suggests a targeted, short-lived campaign rather than a long-standing malicious infrastructure. If you visited lion-trust.app, do not enter any personal, financial, or login information. Disconnect from the site immediately and avoid clicking any links or downloading files. Check your financial accounts for unauthorized activity and consider changing passwords for any accounts you may have accessed through this domain. Report the domain to your IT security team or to PhishDestroy using the seed identifier f6b7e5. Enable multi-factor authentication on all critical accounts and monitor for suspicious emails or messages referencing this domain. If you entered credentials, revoke access immediately through your account settings and enable additional security controls such as login alerts or device restrictions. Always verify the legitimacy of financial websites by checking official sources or contacting the institution directly through verified contact information. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260518-BD0591 Favicon MD5: f2dd9a613970660c99f16f10e9d9d662 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/lion-trust.app/ JSON API: https://api.destroy.tools/v1/check?domain=lion-trust.app Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 151,200 domains (36,133 alive under monitoring, 114,655 confirmed takedowns/dead). Site: https://phishdestroy.io