REGISTRAR NEGLIGENCE · EGREGIOUS Tucows Domains Inc. was notified 5 months ago — the threat is still operational.

Why this matters — ICANN RAA §3.18 obligation & victim-assistance

On 2026-02-08 18:29:20 UTC PhishDestroy delivered an evidence-backed abuse report (repeated 7 times, most recently 2026-02-08 18:29:20 UTC) to domainabuse@tucows.com with VirusTotal detections, urlscan capture, legal violations, and full screenshot evidence. More than 5 months later, the phishing infrastructure remains reachable .

Under ICANN RAA §3.18 accredited registrars are contractually obliged to “take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse.” Silence beyond 24 hours after a documented notification with verifiable evidence is not a timing issue — it is a policy decision to let the operation continue. PhishDestroy\'s position: where a registrar fails to act on clear evidence, the registrar has aligned itself with the operator of the scheme and bears co-responsibility for downstream harm caused to victims from the moment of notification onward.

Victim-assistance obligation. If Tucows Domains Inc. doesn't consider the listed detections enough proof — that is interesting in itself, given the volume of independent vendor confirmations. But after 7 separate notifications over 5 months, with the operation still active, the registrar took no measurable action to mitigate the harm caused by their client. The reasonable next step is direct help to any identified victims — contact & payment-trail disclosure, abuse-thread transcripts, registrant data preservation — since the registrar chose, by inaction, to extend the window of damage.

Elapsed since first report

5 months

Reports sent

Latest case ID

PD-1770575273-lucknight.com

Current status

Serving traffic (alive)

lucknight[.]com

Bericht zu Domänensicherheit und Bedrohungsinformationen

“Lucknight | XXX”

13/91 VT URLQuery: 100 OTX: 1 pulse Unverified Dec 16, 2025 Unavailable since Mar 01, 2026 Genericcrypto Betrug bei Glücksspielen Impersonation 7 Reports Sent CDN + more

93 Risikobewertung

Lokalisierte Berichtsübersicht

lucknight.com: 13/91 VirusTotal-Erkennungen. Prüfen Sie DNS, SSL, Registrar, Blocklisten und Bedrohungsnachweise.

Die ausführliche Analyse von PhishDestroy AI bleibt auf Englisch, damit der ursprüngliche forensische Bericht unverändert bleibt.

PhishDestroy AI

HIGH

The domain lucknight[.]com presents itself as "Lucknight | XXX," indicating a potential adult entertainment or gambling-related service. Based on the high detection rate and security flags, this site likely poses a threat as a malicious or fraudulent platform, possibly used for phishing, malware distribution, or scam operations. The exact nature of the threat is not specified in the data, but the widespread security vendor flags suggest it is unsafe for users.

Technical evidence shows the site was flagged by 16 out of 95 VirusTotal vendors, including ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, and CyRadar. It appears on one blocklist. The domain was registered through Tucows Domains Inc. and created on 2025-10-21. Its IP address is 172.67.149.219, located in the United States and hosted by AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services / WE1, and nameservers are marissa.ns.cloudflare.com and alaric.ns.cloudflare.com.

Currently, the site is down or offline, indicating it may have been taken down or is temporarily inaccessible. The risk level is high due to the significant number of security vendor detections and its presence on blocklists. Users should avoid any interaction with this domain or related resources.

VirusTotal

13 det.

URLQuery

100 det.

OTX AlienVault

1 pulse

URLScan

Report ↗

Alter

9 mo

Observed status

Last known active

DestroyList

Listed

Reports Sent

7 ignored

Datenabdeckung VirusTotal 13 / 91 URLQuery 100 det. OTX 1 pulse CF-Radar clean URLScan report ready DNS-Sperren none SSL no cert WHOIS 9 mo old Screenshot nicht erfasst Weiterleitungskette not probed

Pipeline zur Reaktion auf Sicherheitsbedrohungen

Discovery

Checks

Reports

Availability

22/23

Vorab-Ermittlung und -Erfassung

Bedrohung erkannt

1/1 ✓

Bedrohung erkannt

lucknight.com erkannt und für eine vollständige Analyse in die Warteschlange gestellt

Dec 16, 2025

Threat Intelligence Checks

URLScan.io Snapshot · Cloudflare Radar · Web Archive · VirusTotal · Google Safe Browsing · OTX Threat Intel · Brand Impersonation · Forensic Evidence Collected · Technical Analysis Recorded · Site Came Back Online · Cloudflare Radar Scan · Content Observed Unavailable

12/12 ✓

URLScan.io Snapshot

Submitted to urlscan.io — screenshot, DOM & HTTP transactions captured

Feb 26, 2026

Cloudflare Radar

Scanned via Cloudflare Radar — DNS, certificates & network data

Web Archive

Preserved in Wayback Machine — historical evidence archived

VirusTotal

13 / 91 vendors flagged on VirusTotal

Aug 01, 2026

Google Safe Browsing

Checked via Google-Transparenzbericht

Mar 03, 2026

OTX Threat Intel

Gefunden in 1 OTX pulse on AlienVault OTX

Mar 01, 2026

Brand Impersonation

Impersonation of Genericcrypto

Forensic Evidence Collected

Stored evidence from URLScan.io, stored screenshot

Feb 26, 2026

Technical Analysis Recorded

The report contains stored technology or forensic-analysis results

Aug 01, 2026

Site Came Back Online

Domain is responding again — monitoring resumed

Aug 01, 2026

Cloudflare Radar Scan

Scanned via Cloudflare Radar — network analysis completed

Mar 07, 2026

Content Observed Unavailable

Monitoring recorded an unavailable response (HTTP 666); the cause was not independently established

Mar 01, 2026

Notification Records

Initial Abuse Report (#1) · ICANN Escalation #2 · ICANN Escalation #3 · ICANN Escalation #4 · ICANN Escalation #5 · ICANN Escalation #6 · ICANN Escalation #7 · 7 Reports Filed

8/8 ✓

Initial Abuse Report (#1)

Sent to 1 abuse contact at Tucows Domains Inc. with forensic evidence

domainabuse@tucows.com

Feb 08, 2026

ICANN Escalation #2

Escalation #2 sent to 3 recipients including ICANN Compliance — follow-up record after a previous report