go[.]lacybird[.]academy

This domain, go.lacybird.academy, is currently under investigation for credential-harvesting phishing activity. Infrastructure analysis reveals it resolves to the IP address 216.150.16.193, though no nameservers are currently associated with the domain, which is atypical for legitimate services and may indicate temporary or disposable hosting. The domain appears on one security blocklist and has been blocked by PhishDestroy, suggesting prior detection of malicious behavior. As of July 20, 2026, the domain remains active, increasing the urgency for defenders to monitor or mitigate potential threats. No vendor detections are present in the most recent VirusTotal scan, though this absence does not confirm safety, as phishing domains often evade detection during early deployment or through rapid infrastructure changes. The domain's content has not been fully analyzed, so the specific brand or service being mimicked is unknown. Defenders should treat this domain as high-risk until further evidence is gathered. Recommended actions include blocking the domain at the DNS or proxy level, monitoring for connections to 216.150.16.193, and investigating any internal systems that may have interacted with it. If credential harvesting is confirmed, initiate password resets and multi-factor authentication enforcement for potentially exposed accounts.