lbank[.]date

This domain, lbank.date, operates as a fraudulent cryptocurrency exchange login portal designed to harvest user credentials and facilitate unauthorized account access. Analysis indicates the site mimics legitimate exchange interfaces, specifically targeting users of the LBANK platform, to deceive victims into entering sensitive login details, two-factor authentication codes, and private wallet keys. The infrastructure is optimized for rapid credential collection and immediate fund transfer initiation, characteristic of high-velocity phishing campaigns targeting digital asset holders. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on April 06, 2026, through NameMart Pte. Ltd., a registrar frequently associated with short-lived phishing domains. It resolves to the IP address 188.114.97.3 and has been flagged by 13 out of 95 security vendors on VirusTotal, including detection as a banking phishing threat. The domain appears on three independent security blocklists and has been proactively blocked by multiple browser-based security extensions. A trust score of 0/100 from Gridinsoft further corroborates its malicious classification. The site has since been taken offline, though related infrastructure may remain active. Users who visited lbank.date or entered credentials on the site should assume full account compromise. Immediate action is required: revoke all active sessions, reset passwords using a secure device, and enable multi-factor authentication via an authenticator app—not SMS. Monitor linked accounts for unauthorized transactions and report suspicious activity to the legitimate exchange. Consider migrating assets to a new wallet if private keys were exposed. Security teams should update blocklists with the domain and IP, and monitor for related domains registered through the same registrar or resolving to the same infrastructure.