leboncoinpaiement[.]oxwn[.]fr

The domain leboncoinpaiement.oxwn.fr has been identified as a phishing threat, specifically engaging in brand impersonation. This malicious site is designed to deceive users into believing they are interacting with a legitimate service, likely to steal sensitive information such as login credentials or financial data. The fraudulent page, titled 'Valide – Service enregistrement', tries to mimic legitimate online services, increasing the risk of successful phishing attempts.

Technical analysis shows that this domain is flagged by 18 out of 95 security vendors on VirusTotal, indicating significant recognition as a threat. The domain was registered through IONOS SE on November 4, 2025, and has appeared on at least one security blocklist, specifically blocked by PhishDestroy. It resolves to the IP address 2001:8d8:100f:f000::200, located in Germany under the AS8560 IONOS SE network. Notably, the domain lacks an SSL certificate, which is a common trait of phishing sites aiming to avoid detection.

Users who have visited leboncoinpaiement.oxwn.fr are advised to take immediate action. They should conduct a thorough review of any accounts that may have been accessed via this domain, change passwords, and monitor financial statements for unauthorized transactions. It is also advisable to run a comprehensive security scan on their devices to detect and remove any potential malware. Reporting the incident to relevant authorities and the legitimate brand being impersonated can aid in mitigating further harm.