lis-skians[.]com

This domain is flagged as an elevated-risk generic phishing site designed to harvest user credentials through fake login pages. Infrastructure analysis reveals the domain was created on February 20, 2025, and is registered through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The site resolves to the IP address 58.64.137.69, which has been linked to previous phishing campaigns, and appears on one security blocklist. VirusTotal detection rates show 16 out of 95 security vendors flagging the domain as malicious, while additional intelligence indicates it is actively blocked by anti-phishing systems for impersonation attempts.

Technical indicators further confirm the domain's malicious intent. The creation date of February 2025 suggests a short-lived operation, a common tactic among phishing domains to evade detection. The IP address 58.64.137.69 has been observed hosting multiple suspicious domains with similar patterns, including identical page titles and minimal content structure. The domain's presence on a security blocklist and its current offline status may indicate takedown efforts, though such domains often reappear under different infrastructure. No legitimate services or historical data are associated with this domain, reinforcing its classification as a fraudulent entity.

Users and organizations are advised to implement immediate mitigation measures to prevent credential theft. Block the domain lis-skians.com and its associated IP address 58.64.137.69 at the network level using firewalls or DNS filtering. Deploy email and web gateway protections to detect and quarantine phishing attempts referencing this domain. Educate users on identifying phishing indicators, such as mismatched URLs, suspicious login prompts, and unsolicited requests for credentials. Monitor for any re-emergence of the domain or similar infrastructure, as threat actors often reuse tactics across multiple campaigns. If credentials were entered on this site, reset passwords immediately and enable multi-factor authentication on all affected accounts.