REGISTRAR NEGLIGENCE · EGREGIOUS Tucows Domains Inc. was notified 5 months ago — the threat is still operational.

Why this matters — ICANN RAA §3.18 obligation & victim-assistance

On 2026-02-08 18:29:20 UTC PhishDestroy delivered an evidence-backed abuse report (repeated 7 times, most recently 2026-02-08 18:29:20 UTC) to domainabuse@tucows.com with VirusTotal detections, urlscan capture, legal violations, and full screenshot evidence. More than 5 months later, the phishing infrastructure remains reachable .

Under ICANN RAA §3.18 accredited registrars are contractually obliged to “take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse.” Silence beyond 24 hours after a documented notification with verifiable evidence is not a timing issue — it is a policy decision to let the operation continue. PhishDestroy\'s position: where a registrar fails to act on clear evidence, the registrar has aligned itself with the operator of the scheme and bears co-responsibility for downstream harm caused to victims from the moment of notification onward.

Victim-assistance obligation. If Tucows Domains Inc. doesn't consider the listed detections enough proof — that is interesting in itself, given the volume of independent vendor confirmations. But after 7 separate notifications over 5 months, with the operation still active, the registrar took no measurable action to mitigate the harm caused by their client. The reasonable next step is direct help to any identified victims — contact & payment-trail disclosure, abuse-thread transcripts, registrant data preservation — since the registrar chose, by inaction, to extend the window of damage.

Elapsed since first report

5 months

Reports sent

Latest case ID

PD-1770575273-lucknight.com

Current status

Serving traffic (alive)

فحص التصيد والأمان للنطاق lucknight.com

تقرير أمن النطاقات ومعلومات التهديدات

“Lucknight | XXX”

13/91 VT URLQuery: 100 OTX: 1 pulse Unverified Dec 16, 2025 Unavailable since Mar 01, 2026 Genericcrypto احتيال على المقامرين Impersonation 7 Reports Sent CDN + more

93 درجة المخاطر

ملخص التقرير

lucknight.com: أظهرت نتيجة VirusTotal أن 13 من أصل 91 محركًا رصد هذا النطاق. راجع DNS وSSL وجهة التسجيل وقوائم الحظر.

يبقى تحليل PhishDestroy AI المفصل أدناه باللغة الإنجليزية للحفاظ على السجل الجنائي الرقمي الأصلي.

PhishDestroy AI

HIGH

The domain lucknight[.]com presents itself as "Lucknight | XXX," indicating a potential adult entertainment or gambling-related service. Based on the high detection rate and security flags, this site likely poses a threat as a malicious or fraudulent platform, possibly used for phishing, malware distribution, or scam operations. The exact nature of the threat is not specified in the data, but the widespread security vendor flags suggest it is unsafe for users.

Technical evidence shows the site was flagged by 16 out of 95 VirusTotal vendors, including ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, and CyRadar. It appears on one blocklist. The domain was registered through Tucows Domains Inc. and created on 2025-10-21. Its IP address is 172.67.149.219, located in the United States and hosted by AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services / WE1, and nameservers are marissa.ns.cloudflare.com and alaric.ns.cloudflare.com.

Currently, the site is down or offline, indicating it may have been taken down or is temporarily inaccessible. The risk level is high due to the significant number of security vendor detections and its presence on blocklists. Users should avoid any interaction with this domain or related resources.

VirusTotal

13 det.

URLQuery

100 det.

OTX AlienVault

1 pulse

URLScan

Report ↗

العمر

9 mo

Observed status

Last known active

قائمة الإتلاف

Listed

Reports Sent

7 ignored

نطاق تغطية البيانات VirusTotal 13 / 91 URLQuery 100 det. OTX 1 pulse رادار CF clean URLScan report ready حجب عناوين DNS none SSL no cert WHOIS 9 mo old Screenshot لم يتم تسجيله سلسلة إعادة التوجيه not probed

مسار الاستجابة للتهديدات Pipeline

Discovery

Checks

Reports

Availability

22/23

الاكتشاف والاستيعاب الاستباقي

تم استيعاب التهديد

1/1 ✓

تم استيعاب التهديد

lucknight.com تم اكتشافها وإدراجها في قائمة الانتظار لإجراء تحليل شامل

Dec 16, 2025

Threat Intelligence Checks

URLScan.io Snapshot · Cloudflare Radar · Web Archive · VirusTotal · Google Safe Browsing · OTX Threat Intel · Brand Impersonation · Forensic Evidence Collected · Technical Analysis Recorded · Site Came Back Online · Cloudflare Radar Scan · Content Observed Unavailable

12/12 ✓

URLScan.io Snapshot

Submitted to urlscan.io — screenshot, DOM & HTTP transactions captured

Feb 26, 2026

رادار Cloudflare

Scanned via رادار Cloudflare — DNS, certificates & network data

Web Archive

Preserved in آلة الزمن — historical evidence archived

VirusTotal

13 / 91 vendors flagged on VirusTotal

Aug 01, 2026

Google Safe Browsing

Checked via تقرير الشفافية من Google

Mar 03, 2026

OTX Threat Intel

موجود في 1 OTX pulse on AlienVault OTX

Mar 01, 2026

Brand Impersonation

Impersonation of Genericcrypto

Forensic Evidence Collected

Stored evidence from URLScan.io, stored screenshot

Feb 26, 2026

Technical Analysis Recorded

The report contains stored technology or forensic-analysis results

Aug 01, 2026

Site Came Back Online

Domain is responding again — monitoring resumed

Aug 01, 2026

Cloudflare Radar Scan

Scanned via Cloudflare Radar — network analysis completed

Mar 07, 2026

Content Observed Unavailable

Monitoring recorded an unavailable response (HTTP 666); the cause was not independently established

Mar 01, 2026

Notification Records

Initial Abuse Report (#1) · ICANN Escalation #2 · ICANN Escalation #3 · ICANN Escalation #4 · ICANN Escalation #5 · ICANN Escalation #6 · ICANN Escalation #7 · 7 Reports Filed

8/8 ✓

Initial Abuse Report (#1)

Sent to 1 abuse contact at Tucows Domains Inc. with forensic evidence

domainabuse@tucows.com

Feb 08, 2026

ICANN Escalation #2

Escalation #2 sent to 3 recipients including ICANN Compliance — follow-up record after a previous report