lndteam[.]beer

This domain, lndteam.beer, is identified as a high-risk phishing site targeting users of the Lightning Network, a layer-2 payment protocol for Bitcoin. The domain impersonates legitimate Lightning Network development teams or service providers, likely aiming to harvest credentials, private keys, or trick users into executing malicious transactions. Given the context of its naming and infrastructure, it may specifically deploy crypto drainer scripts or fake wallet interfaces to siphon funds from victims' cryptocurrency wallets. Analysis indicates the domain was registered on March 25, 2026, through DYNADOT LLC, a registrar frequently associated with malicious domains. It resolves to the IP address 178.16.52.101, hosted by Omegatech LTD in Germany. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal reports 20 out of 95 security vendors flagging lndteam.beer as malicious, with detections spanning phishing, fraud, and cryptocurrency-related threats. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its accessibility and automation. Users who visited lndteam.beer should immediately revoke any permissions granted to the site in browser-based cryptocurrency wallets or extensions. All active sessions should be terminated, and any credentials or private keys entered on the site must be considered compromised. Users are advised to transfer funds from potentially exposed wallets to new, secure addresses and monitor transaction histories for unauthorized activity. System scans using updated security tools are recommended to detect any residual malware or scripts. Network-level blocking of the domain and its associated IP (178.16.52.101) should be implemented to prevent further access.