lbank-kor[.]com

This domain, lbank-kor.com, is identified as an active cryptocurrency credential phishing site impersonating the legitimate LBank exchange platform. The site presents a fraudulent login interface titled 'LBank 로그인 - 안전한 암호화폐 거래소 | LBank Login,' designed to harvest user credentials for unauthorized access to digital asset accounts. Analysis indicates the absence of a known drainer kit, suggesting a focused credential theft operation rather than direct wallet-draining functionality. Infrastructure analysis reveals the domain was registered on June 02, 2024, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. The domain resolves to the IP address 186.2.175.79, hosted on infrastructure previously linked to phishing campaigns targeting financial services. As of the latest assessment, the domain is flagged by 3 out of 95 security vendors on VirusTotal, indicating limited but growing detection coverage. The SSL certificate is issued by Let's Encrypt, providing HTTPS encryption that enhances the site's appearance of legitimacy. No listings were found on Google Safe Browsing at the time of analysis, and blocklist monitoring services report minimal coverage, with fewer than five public blocklists flagging the domain. The phishing site remains active and accessible, posing a continued risk to cryptocurrency users who may mistake it for the legitimate LBank platform. Response actions by hosting providers and registrars have yet to result in takedown, likely due to delayed abuse reporting or jurisdictional challenges. The remaining risk is classified as high due to the domain's convincing mimicry of the target brand, active HTTPS encryption, and low detection rates among security engines. Users are advised to verify domain authenticity through official channels, enable multi-factor authentication on cryptocurrency accounts, and report suspicious domains to relevant security organizations for further investigation and mitigation.