le[.]lrtkzy18[.]shop

This domain le.lrtkzy18.shop is currently flagged as a generic phishing infrastructure. The domain was registered through GoDaddy.com, LLC on 27 November 2025 and is hosted behind Cloudflare (AS13335) with the IP address 104.21.19.131 located in the United States. DNS resolution uses the Cloudflare nameservers damian.ns.cloudflare.com and melinda.ns.cloudflare.com. No TLS certificate is presented, and an HTTP request returns a 404 page title, indicating that the site is not serving content at the time of analysis.

The Gridinsoft trust scoring system assigns a score of 0 out of 100, reflecting a lack of confidence in the domain’s legitimacy. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal analysis shows that 14 of 95 scanned security vendors flagged the domain, reinforcing the suspicion of malicious use. The domain’s current status is offline, which may be the result of takedown actions or temporary hosting changes.

Observations confirm the presence of generic phishing indicators but provide no details on the specific payload, targeted brand, or credential‑capture mechanisms. Because the underlying content is not accessible, the full scope of the phishing campaign cannot be determined. Defenders should continue to block the domain at perimeter devices, monitor DNS queries for the associated IP address and nameservers, and keep the domain listed in URL filtering and threat‑intelligence feeds. Ongoing surveillance of the IP range and Cloudflare ASN is recommended to detect any re‑use of the infrastructure for future campaigns.