lbank-cn[.]com

Analysis indicates that lbank-cn.com is an active phishing infrastructure targeting users of the LBank platform. The domain was registered on 31 May 2026 via Gname.com Pte. Ltd. and resolves to the IPv4 address 186.2.175.79, which is hosted by Iqweb LLC in Belize. The site presents a valid TLS certificate issued by Let’s Encrypt (YR1) and responds with HTTP 200, suggesting the operator has obtained a functional web server. Nameserver configuration uses three CloudNS entries (pns71.cloudns.net, pns72.cloudns.com, pns73.cloudns.net), a pattern frequently observed in malicious deployments that rely on rapid DNS updates. Automated scans identified the front‑end stack as Ant Design, Vue.js, jQuery and Hammer.js, while DDoS‑Guard is present, indicating the use of a third‑party mitigation service to obscure traffic origin. The page title “LBank 登录｜登录您的交易账户” aligns with a credential‑harvesting campaign aimed at the LBank exchange. The domain is currently listed on three security blocklists and has been flagged by PhishDestroy, MetaMask and SEAL, confirming its malicious classification. VirusTotal reports two positive detections out of 91 scanners, reinforcing the risk. The Gridinsoft trust score of 0/100 further reflects a lack of legitimacy. No additional artifacts such as malicious payloads or command‑and‑control endpoints have been observed, leaving the payload delivery mechanism uncertain. Defenders should immediately block lbank-cn.com at network perimeter and endpoint filters, monitor DNS queries for the associated CloudNS nameservers, and consider sinkholing the IP address. Ongoing telemetry collection is advised to detect any future changes in hosting or certificate renewal.