app[.]lockcoin[.]net

app.lockcoin.net is currently listed as an active generic phishing site. The domain appears on one external security blocklist and is explicitly blocked by the PhishDestroy feed, indicating that at least one reputable anti‑phishing service has observed malicious activity associated with it. VirusTotal records show that the domain was submitted for scanning and examined by 91 AV engines; none of the engines raised a detection at the time of analysis. The report explicitly notes that a lack of detections does not constitute evidence of safety, and the domain remains under investigation.

No public WHOIS or registrar information has been provided, and no details on hosting IP, ASN, or SSL certificate are available in the current intelligence set. Likewise, Safe Browsing status, Open Threat Exchange mentions, and page‑title metadata have not been released, so the surface‑level characteristics of the site cannot be confirmed. The absence of these data points limits the ability to attribute the infrastructure or to assess the sophistication of the phishing kit employed. Given the confirmed blocklist entry and the presence of the domain in a dedicated phishing‑remediation list, defenders should treat any traffic to app.lockcoin.net as hostile.

Recommended actions include adding the domain to DNS‑based deny lists, configuring web‑proxy filters to block HTTP and HTTPS requests, and updating intrusion‑prevention signatures to flag outbound connections. Continuous monitoring of threat‑intel feeds for new detections, changes in blocklist status, or the emergence of additional indicators such as IP addresses or SSL fingerprints is advised. Organizations should also educate end‑users about the risk of unsolicited communications that reference “lockcoin” or similar cryptocurrency terminology, as the domain name suggests a possible focus on crypto‑related credential harvesting.