# PhishDestroy threat dossier — lume-mail.org ================================================================ Fetched: 2026-05-03 11:58:26 UTC Canonical: https://phishdestroy.io/domain/lume-mail.org/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: MetaMask ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain URLQuery: 2 detections Public blocklists: listed on 2 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com Nameservers: roan.ns.cloudflare.com, ursula.ns.cloudflare.com Registered: 2026-04-17 Page title: Lume - Get Rewarded For Your Internet HTTP response: 530 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E7 Expires: 2026-07-16 Status: INVALID chain Fingerprint: bfe3adad883c60954e383a0ef344d4e01d18f7a81012bd8a0163b13b16e2146d ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-17 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-30 13:32:34 UTC (by PhishDestroy tracker) First reported: 2026-04-30 10:34:15 UTC (abuse notice filed) Last verified: 2026-05-03 07:11:56 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dddf0-c601-7432-aa82-f247e8d1085c/ URLQuery: https://urlquery.net/report/8836cbe5-bdac-46ff-82c6-312e7615f7eb Wayback Machine: https://web.archive.org/web/*/lume-mail.org crt.sh CT logs: https://crt.sh/?q=%25.lume-mail.org Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=lume-mail.org AlienVault OTX: https://otx.alienvault.com/indicator/domain/lume-mail.org URLhaus: https://urlhaus.abuse.ch/host/lume-mail.org/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-30 13:33:59 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies lume-mail.org as an active crypto wallet credential drainer site currently under investigation for phishing. The domain exhibits classic drainer kit characteristics including social engineering lures targeting cryptocurrency users and potential exploitation of browser wallet extensions. While specific drainer kit signatures are still being analyzed, the domain's pattern of operation strongly suggests credential harvesting functionality targeting MetaMask and similar wallet users. Brand impersonation analysis shows no direct impersonation of major cryptocurrency brands, suggesting a more generic wallet-draining operation. Technical forensic analysis reveals exact threat indicators: VirusTotal shows 0/95 detection score with no security products currently flagging the payload, PDR Ltd. d/b/a PublicDomainRegistry.com as registrar, resolving to IP 188.114.96.3, domain creation date of April 17, 2026, Let's Encrypt SSL certificate, flagged by Google Safe Browsing (GSB), and listed on 2 security blocklists including MetaMask and SEAL detection systems. The domain's recent creation date combined with active blocking by major security platforms indicates a newly deployed threat infrastructure. Current operational status shows lume-mail.org remains active despite security blocks from MetaMask and SEAL. The site continues to resolve and may be serving malicious payloads to unaware visitors. Response actions include ongoing monitoring by security researchers and continued blocklist propagation. Remaining risk assessment indicates medium-high threat potential due to the domain's recent deployment, lack of current AV detection, and active credential harvesting capabilities targeting cryptocurrency users. Users are advised to avoid this domain entirely and report any suspicious wallet connection requests to their respective wallet providers immediately. [Updates since narrative was generated:] - VirusTotal detections: now 2/91 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260430-1CDFA0 TLS cert SHA-256: bfe3adad883c60954e383a0ef344d4e01d18f7a81012bd8a0163b13b16e2146d ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/lume-mail.org/ JSON API: https://api.destroy.tools/v1/check?domain=lume-mail.org Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 144,981 domains (55,981 alive under monitoring, 88,740 confirmed takedowns/dead). Site: https://phishdestroy.io