hcdistrictclerk[.]lgbkc[.]vip

The domain hcdistrictclerk.lgbkc.vip has been identified as a credential phishing infrastructure targeting users of government or municipal services. Analysis indicates the domain was designed to impersonate official county clerk or district administrative portals, though no specific legitimate brand name was confirmed in initial triage. The domain is currently offline, though prior activity suggests it was actively used in phishing campaigns before takedown measures were applied.

Infrastructure analysis reveals the domain was registered through Namemart Limited on June 12, 2026, an unusually future-dated registration that may indicate attempts to evade detection through temporal anomalies. It resolved to the IP address 188.114.96.3, a host previously associated with other phishing operations. The domain appears on one security blocklist and is flagged by 12 of 95 security vendors on VirusTotal, indicating moderate but consistent detection across industry tools. The SSL certificate was issued by Google Trust Services, a common tactic to lend superficial legitimacy to malicious sites. No additional subdomains or related infrastructure were identified in this investigation.

Current status shows the domain has been taken offline, though residual risk remains due to the future-dated registration and prior hosting on a known malicious IP. Organizations are advised to block the domain and IP at perimeter security controls, including firewalls and email gateways. Security teams should review logs for connections to 188.114.96.3 or attempts to access hcdistrictclerk.lgbkc.vip within the past 30 days. End users who may have interacted with the domain should be instructed to reset credentials for any government or municipal service accounts, particularly if login attempts were made. Monitoring for similar domains registered through Namemart Limited is recommended, as this registrar has been linked to other phishing infrastructure in recent months.