lbank-korea[.]at

Analysis date: July 24 2026. The domain lbank-korea.at was registered on February 27 2026 through the registrar Iqweb. Infrastructure analysis shows the domain resolves to the IPv4 address 186.2.175.29, which is advertised as belonging to AS59692 IQWeb FZ-LLC and is geolocated to Belize. No TLS certificate was observed; the site served only HTTP, indicating a lack of encryption. The page title returned by the server is “LBank 로그인 - 안전한 암호화폐 거래소 | LBank Login”, matching the credential‑phishing classification noted in the intelligence.

Front‑end libraries detected include Ant Design, Vue.js, jQuery, Hammer.js, and the DDoS‑Guard service, suggesting a generic web‑app stack rather than a custom malicious kit. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal reports that one of ninety‑three scanners flagged the domain, providing additional confirmation of malicious intent. The Gridinsoft trust score is 0 out of 100, reinforcing the low credibility of the host. Nameserver delegation points to pns71.cloudns.net, pns72.cloudns.com, pns73.cloudns.net and pns74.cloudns.uk.

Current status is offline, which may be the result of takedown actions or temporary hosting changes. Confidence in the observed indicators is high; however, the limited number of blocklist entries and the single VirusTotal detection leave open the possibility that additional detection sources have not yet indexed the domain. Defenders should continue to monitor the domain and its IP address for any re‑appearance, enforce URL filtering based on the exact hostname, and consider adding the IP to network‑level deny lists. Because the site lacks SSL, any attempted connections will be visible in network logs, facilitating detection. Organizations that use LBank services should remind users to verify the authenticity of login pages and to avoid entering credentials on domains that do not present a valid certificate.