lmwfsg[.]za07[.]com

The domain lmwfsg.za07.com has been identified as a cryptocurrency exchange phishing site targeting users with falsified market data interfaces. Analysis of the page title, 'ou易-快速查询交易深度，市场数据分析,' suggests an attempt to impersonate legitimate trading platforms by mimicking tools for transaction depth queries and market analysis. The domain is currently offline, though prior activity indicates a focused effort to harvest credentials or financial information from unsuspecting traders. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameSilo, LLC, an entity frequently associated with high-risk registrations. It resolves to the IP address 38.54.101.192, hosted under AS138915 (Kaopu Cloud HK Limited), a provider commonly linked to malicious infrastructure. The SSL certificate is issued by Let's Encrypt (R12), a low-assurance issuer often exploited for short-lived phishing campaigns. Detection metrics indicate 12 of 95 security vendors on VirusTotal flagged this domain as malicious, while it appears on one additional security blocklist. The domain was previously blocked by PhishDestroy, reinforcing its classification as a confirmed phishing threat. Current status confirms the domain has been taken offline, though the underlying infrastructure remains a potential vector for future attacks. Organizations and individuals are advised to block the domain and its associated IP (38.54.101.192) at the network perimeter. Security teams should monitor for similar domains registered through NameSilo or resolving to Kaopu Cloud HK Limited IPs, particularly those using Let's Encrypt certificates. End-users should be educated on verifying SSL certificate issuers and scrutinizing domain names, especially those mimicking cryptocurrency platforms. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended.