leboncoinlivraison[.]rest

Analysis identifies leboncoinlivraison.rest as a high-risk generic_phishing domain. No specific impersonated brand or phishing kit information is available from the collected intelligence; however, the combination of recent registration, multiple threat intelligence references, and security detections is consistent with infrastructure used in credential theft and social-engineering campaigns. The observed page title, 'Just a moment...', indicates the domain was fronted by a traffic-filtering or challenge mechanism prior to being taken offline, a technique commonly used to restrict analysis and selectively deliver content.

Infrastructure analysis reveals that the domain resolves to IP address 172.67.190.233. VirusTotal reports detections from 15 of 95 security vendors. The domain was registered through Web Commerce Communications Ltd. and was created on June 12, 2026. Google Safe Browsing classifies the domain under the SOCIAL_ENGINEERING category. The domain appears on 3 security blocklists and is specifically blocked by PhishDestroy, OISD, and InversionDNS. Additional intelligence shows a Gridinsoft trust score of 0/100 and presence in 6 AlienVault OTX threat intelligence pulses. Detected technologies include Cloudflare and HTTP/3. These indicators collectively support the high-risk assessment.

The domain is currently offline, reducing immediate exposure; however, historical indicators suggest it previously presented sufficient risk to trigger multiple independent detections and blocklist inclusions. Defensive actions should include maintaining domain- and IP-based blocking controls, reviewing DNS, proxy, and web access logs for prior connections to 172.67.190.233, and investigating any user interaction that occurred before takedown. Organizations should retain monitoring for re-registration attempts, related infrastructure, and lookalike domains leveraging similar naming patterns. Although the current status is taken offline, the combination of 15/95 detections, 3 blocklists, a 0/100 trust score, and 6 threat-intelligence pulse references indicates residual risk from associated infrastructure and potential future reuse.