lobzik[.]info

Analysis indicates that the domain lobzik.info was registered on February 21, 2026 and quickly surfaced as a phishing vector. The domain resolves to IP 141.8.192.100, which is assigned to ASN 35278 (SPRINTHOST.RU LLC) in Russia. The server presents an SSL certificate issued by the R3 intermediate, typical of Let’s Encrypt, confirming that HTTPS is available but does not imply legitimacy. Independent threat‑intelligence feeds have taken action: PhishDestroy has actively blocked the domain, and it appears on a single public blocklist.

Gridinsoft assigns a trust score of 0 out of 100, indicating maximal suspicion. AlienVault OTX lists the domain in one pulse, and VirusTotal records six positive detections out of ninety‑three scanning engines, reinforcing the malicious classification. The site is currently taken offline, but the infrastructure remains in place and could be re‑activated. No public page title, brand targeting, or malware kit information has been disclosed, leaving the exact phishing lure unknown.

Defenders should continue to block the domain at DNS and proxy layers, add the associated IP address to blacklists, and monitor for any re‑registration or activity from the same hosting ASN. Incorporating the domain into internal threat‑intel feeds will improve detection by security appliances that reference the observed blocklist and VirusTotal signals. Ongoing vigilance is warranted because the underlying hosting provider may host additional malicious domains.