lion-trust[.]app

PhishDestroy identifies lion-trust.app as an active phishing domain designed to impersonate a legitimate investment or financial service, tricking visitors into surrendering sensitive credentials or payment details. The site leverages spoofed branding and urgent messaging to convince users of its authenticity, often mimicking well-known financial institutions or crypto platforms. Once credentials are entered, threat actors harvest them for fraudulent transactions, identity theft, or further phishing campaigns. This domain was flagged by 15 out of 95 security vendors on VirusTotal, indicating widespread suspicion within the threat intelligence community. It resolves to IP address 151.158.1.161 and holds an SSL certificate issued by DigiCert Inc, which threat actors often abuse to appear legitimate. The domain was registered on May 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk or malicious registrations. This domain poses an elevated risk due to its recent creation, low detection coverage, and deceptive branding strategy. Threat actors commonly register such domains in bulk and deploy them quickly to capitalize on current events, trending topics, or financial trends. The use of a valid SSL certificate further lowers user suspicion, making it easier to trick individuals into disclosing login credentials or financial information. Because the domain is still young, it may not yet appear on many blocklists, increasing the window of opportunity for attackers. The combination of low detection (15/95), recent registration date, and hosting on a dedicated IP suggests a targeted, short-lived campaign rather than a long-standing malicious infrastructure. If you visited lion-trust.app, do not enter any personal, financial, or login information. Disconnect from the site immediately and avoid clicking any links or downloading files. Check your financial accounts for unauthorized activity and consider changing passwords for any accounts you may have accessed through this domain. Report the domain to your IT security team or to PhishDestroy using the seed identifier f6b7e5. Enable multi-factor authentication on all critical accounts and monitor for suspicious emails or messages referencing this domain. If you entered credentials, revoke access immediately through your account settings and enable additional security controls such as login alerts or device restrictions. Always verify the legitimacy of financial websites by checking official sources or contacting the institution directly through verified contact information.