lbank[.]lc

This domain lbank.lc is currently active and classified as a banking phishing site. The site presents the page title “Lbank Markets”, indicating an attempt to lure victims into a financial service context. Registration data shows the domain was created on 24 February 2026. TLS is provided by Google Trust Services under the WE1 certificate, and the site is served through Cloudflare, using Vue.js and HTTP/3. DNS resolution points to 172.67.185.196, an IP owned by Cloudflare (AS13335) located in the United States. The HTTP response is a 301 redirect, suggesting additional infrastructure behind the initial request. Reputation services have flagged the domain: one of ninety‑three VirusTotal scanners reported it, Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on three public blocklists. It is already blocked by PhishDestroy, MetaMask, and SEAL. Nameservers are archer.ns.cloudflare.com and jean.ns.cloudflare.com. Defenders should treat lbank.lc as high‑risk. Immediate actions include adding the domain and its IP address to outbound and inbound deny lists, updating URL filtering policies, and monitoring DNS queries for the associated Cloudflare nameservers. Because the site employs a legitimate SSL certificate, TLS inspection may be required to uncover any embedded malicious payloads. Continuous threat‑intel feeds should be consulted for any new indicators, and traffic to the domain should be logged for forensic analysis. Until further content analysis is performed, the presence of the domain in network logs should be considered a probable compromise attempt.