lbank-india[.]at

Analysis of lbank-india.at confirms its classification as an active banking phishing domain, targeting users with fraudulent financial credential harvesting infrastructure. As of July 27, 2026, the domain returns an HTTP 200 status, indicating a live server hosting content. Six of 91 security vendors on VirusTotal have flagged the domain, and it appears on at least one security blocklist, including PhishDestroy, which currently blocks access.

The domain's registration and hosting details remain unconfirmed in available intelligence, but its naming convention—combining 'lbank' with a regional identifier—strongly suggests an attempt to impersonate a legitimate cryptocurrency or financial services platform. No specific phishing kit or brand confirmation is present in the data, though the domain structure aligns with known patterns used in credential theft campaigns. Defenders should treat this domain as high-risk and prioritize blocking at the DNS or network level.

Further investigation into associated IP infrastructure, SSL certificates, and WHOIS records is recommended to identify linked threat actors or additional malicious domains. Given its active status and detection by multiple security vendors, organizations should assume this domain is actively targeting users and adjust monitoring and response protocols accordingly.