laend[.]digital

PhishDestroy identifies laend.digital as an active credential-harvesting domain posing as a legitimate service to deceive users into surrendering sensitive login details. This domain leverages a recently issued SSL certificate from Let’s Encrypt to appear trustworthy, resolving to IP address 172.67.183.79. Despite its clean VirusTotal score of 0 detections out of 95 engines, the domain’s recent creation date of April 1, 2026, and registration through PDR Ltd. d/b/a PublicDomainRegistry.com raise immediate red flags. The absence of historical blocklist entries suggests this is a newly deployed threat, likely operating under the radar to maximize its window of opportunity. This domain is particularly insidious due to its fresh registration and clean reputation on detection platforms. VirusTotal’s 1/95 score indicates no proactive blocking by major antivirus vendors, while the registrar’s association with PublicDomainRegistry.com points to a low-cost, high-volume domain strategy favored by cybercriminals. The IP address 172.67.183.79 is part of Cloudflare’s infrastructure, which threat actors frequently exploit to obscure their true origins. The April 1, 2026 creation date is suspiciously close to the present, suggesting this domain was registered with malicious intent almost immediately prior to deployment. Users who have visited laend.digital should assume their credentials may have been compromised. Immediately change passwords for any accounts associated with this domain, enable multi-factor authentication where available, and monitor accounts for unusual activity. Avoid reusing passwords across services, and consider using a password manager to mitigate risks. Organizations should block this domain at the network level and inspect DNS logs for any internal resolutions to 172.67.183.79. If this domain impersonates a known brand or service, report it to the legitimate entity and warn users of the ongoing campaign.