lgtgroupcapital[.]com

This domain, lgtgroupcapital.com, is identified as a credential harvesting phishing site targeting financial sector users. Analysis indicates the domain is currently offline, though it previously impersonated LGT Group, a legitimate private banking and asset management institution. The threat type is classified as generic_phishing with an elevated risk level due to its potential to deceive users into disclosing sensitive login credentials or financial information. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on March 02, 2026, an unusual future date that may indicate an attempt to evade detection or automated analysis. It resolves to the IP address 104.21.89.51, a Cloudflare-associated address commonly used to mask malicious infrastructure. The domain is flagged by 3 of 95 security vendors on VirusTotal, and it appears on one security blocklist, further corroborating its malicious nature. The page title, 'Lgt group,' closely mimics the branding of the legitimate entity, increasing the likelihood of successful social engineering attacks. Current status indicates the domain has been taken offline, though residual risk remains due to potential re-activation or migration to alternative infrastructure. Organizations and users are advised to block the domain and its associated IP address at the network perimeter. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range. End-users who may have interacted with this domain should be instructed to reset credentials immediately and enable multi-factor authentication on all financial and sensitive accounts. Proactive threat hunting for indicators of compromise, such as unusual login attempts or unauthorized transactions, is recommended.