findmobile[.]lk

The domain findmobile.lk was a generic phishing site posing as an 'IMEI Status Checker for Stolen or Lost Devices'. It did not impersonate a specific brand or deploy a crypto drainer kit. As of the latest verification, findmobile.lk has been taken offline, but it previously exhibited elevated risk due to its phishing activity targeting users seeking device verification services.

Technical analysis of findmobile.lk revealed 6 of 95 VirusTotal security vendors flagged the domain, including detections by alphaMountain.ai, CyRadar, and Fortinet. The domain was created on February 21, 2026, and resolved to the IP address 74.50.79.163, hosted on AS19318 Interserver, Inc in the US. It appeared on 1 security blocklist (PhishDestroy) and was included in 1 AlienVault OTX threat intelligence pulse. The SSL certificate was issued by Let's Encrypt (E7), and the site employed technologies such as Firebase, Leaflet, Bootstrap, and Cloudflare. MX records pointed to mail.findmobile.lk, and nameservers were vda7400a.trouble-free.net and vda7400b.trouble-free.net. Google Safe Browsing did not flag the domain at the time of assessment.

Users who interacted with findmobile.lk should assume their credentials may have been compromised. Immediate actions include changing passwords for any accounts accessed while the site was active, enabling two-factor authentication (2FA) where available, and monitoring accounts for unauthorized activity. Victims are advised to report the phishing domain to their local cybercrime unit, their email provider, and platforms like Google Safe Browsing or PhishTank to aid in broader mitigation efforts.