lprcn[.]biz

PhishDestroy identifies lprcn.biz as an active fake-login phishing domain with an elevated risk level.

This domain was flagged by PhishDestroy’s threat-intelligence pipeline as a generic phishing host designed to harvest user credentials. VirusTotal reports that only 1 out of 95 participating security vendors currently detect lprcn.biz as malicious. The infrastructure footprint points to a single IPv4 address, 91.206.71.2, operated by NICENIC INTERNATIONAL GROUP CO., LIMITED. Domain registration records show lprcn.biz was created on April 25, 2021 via the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED and currently holds a Google Trust Services SSL certificate, indicating the adversary is using legitimate-appearing TLS to lower user suspicion.

Concrete technical indicators include the low but non-zero detection rate (1/95 on VirusTotal at time of analysis), the recent creation date, and the fact that the domain resolves to a bulletproof-hosting IP with no known block-list inclusions at present. These factors collectively elevate the risk of successful credential theft in targeted campaigns.

To mitigate exposure, users should avoid entering any login credentials on lprcn.biz. Verify the intended destination URL through an independent, trusted source before submitting sensitive information. Organizations may wish to pre-emptively block the domain and its resolving IP address at network egress points. Report any observed credential submission to PhishDestroy for rapid takedown and blacklist propagation.