lycory[.]bet

Analysis indicates lycory.bet operates as a brand impersonation vector directed at foundation. The site title references rewards and luck to mimic legitimate interfaces while the infrastructure supports deceptive credential collection or asset redirection. Offline status at time of review does not eliminate residual risk from prior active periods or cached copies distributed through search or messaging channels.

Infrastructure analysis reveals exact indicators including VirusTotal score of 5 out of 95 security vendors, single blocklist appearance under PhishDestroy, resolution to IP 104.21.112.1, registration through Global Domain Group LLC, and creation date of January 11 2025. The certificate issued by Let's Encrypt further aligns with patterns observed in transient impersonation deployments. These metrics collectively establish elevated risk classification without reliance on generic indicators.

If access occurred, immediate steps include password resets for any entered foundation-related accounts, review of transaction histories for unauthorized movements, and device scans using updated endpoint detection tools. Report the encounter to relevant brand abuse channels and avoid re-entry of credentials on similar unverified domains. Continued monitoring of financial and authentication logs remains advisable for 30 days following exposure.