user[.]lock[.]web[.]id

This domain, user.lock.web.id, is currently active and resolves to the IPv4 address 188.114.97.3. The domain is listed on a single security blocklist and has been flagged by one of ninety‑five VirusTotal scanners, indicating that at least one security vendor has identified malicious behavior. The nameserver configuration could not be retrieved (NS_NOT_FOUND), and no additional infrastructure details are available. PhishDestroy has already added the domain to its blocklist, confirming its use in a phishing campaign classified as generic phishing with a high risk rating. Because the domain remains resolvable and the threat classification is high, defenders should immediately block traffic to user.lock.web.id at the perimeter and proxy layers, enforce DNS sink‑holing for the resolved IP, and monitor for any authentication attempts targeting the domain. Continuous re‑evaluation is advised, as further detections may emerge from additional scanners or threat‑intel feeds.