lionsenergy[.]net

PhishDestroy identifies lionsenergy.net as an active fake energy provider phishing campaign posing as a legitimate energy services provider. The domain leverages social engineering to deceive users into submitting sensitive account or payment details under the guise of energy bill verification. With a risk level marked as "under_investigation," this threat requires immediate attention due to its potential to harvest credentials and financial data at scale. This domain was flagged with 0 out of 95 VirusTotal detections, indicating it remains largely undetected by mainstream security engines as of current telemetry. The domain lionsenergy.net resolves to IP address 217.182.199.96, which is hosted by HOSTINGER operations, UAB using their registrar infrastructure. The domain was created on December 20, 2023, suggesting a recently established campaign designed to evade legacy detection systems. No entries were found on major blocklists at the time of analysis, and trust indicators such as domain age and hosting reputation are artificially inflated due to the recent registration and shared hosting environment. Mitigation for this threat requires organizations and end users to block network-level access to lionsenergy.net and its associated IP address 217.182.199.96 at the firewall or DNS layer. Users should avoid clicking links in unsolicited emails or messages referencing energy billing or account suspension, especially those claiming to originate from "Lions Energy." If exposure occurs, users must change passwords associated with energy accounts, enable multi-factor authentication where available, and monitor financial statements for unauthorized transactions. Security teams should add indicators of compromise (IOCs) — including the domain, IP, and any embedded URLs — to email filtering rules and network intrusion detection systems to prevent lateral spread or credential harvesting campaigns leveraging this infrastructure.