lcard-50[.]cfd

This domain, lcard-50.cfd, is identified as a credential harvesting phishing infrastructure targeting users through deceptive login interfaces. Analysis indicates the site was designed to mimic legitimate authentication portals, likely to capture sensitive account details such as usernames, passwords, and potentially multi-factor authentication codes. The domain’s page title, matching its URL structure, suggests a lack of effort to disguise its fraudulent intent, a common tactic in large-scale phishing campaigns. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain is flagged by 18 out of 95 security vendors on VirusTotal, including detections for generic phishing and credential theft. It appears on two independent security blocklists and is explicitly labeled as phishing by Google Safe Browsing. Registered on February 21, 2026, through Web Commerce Communications Limited, the domain resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). Notably, the site lacks an SSL certificate, increasing the likelihood of interception or further malicious redirection. Users who accessed lcard-50.cfd should immediately reset credentials for any accounts entered on the site, particularly if reused across platforms. Monitor associated accounts for unauthorized activity, including financial transactions or identity verification requests. Organizations should update internal blocklists to include this domain and its resolving IP, while endpoint protection systems should be configured to detect and prevent access to related infrastructure. Given the domain’s current offline status, continued vigilance is advised, as threat actors may reactivate or migrate to similar domains.