lumialpha[.]org

This domain, lumialpha.org, is flagged for elevated-risk credential theft targeting users of contract-for-difference (CFD) trading platforms. Analysis indicates the site impersonates legitimate trading services, presenting fake interfaces for stocks, gold, oil, and indices to harvest login credentials and financial account details. The specific focus on CFD trading suggests an intent to compromise high-value brokerage accounts, enabling unauthorized transactions or fund transfers. Infrastructure analysis reveals multiple concerning indicators. The domain was registered through Ultahost, Inc. on October 30, 2025, with an unusually future creation date that may indicate an attempt to evade reputation-based filters. It resolves to the IP address 84.32.84.186 and uses a Let's Encrypt SSL certificate to appear legitimate. Security vendor detections total 15 out of 95 on VirusTotal, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently offline, though this status may change. Mitigation steps for credential theft of this nature include immediate password resets for any accounts accessed via this domain, particularly financial or trading accounts. Users should enable multi-factor authentication (MFA) on all trading platforms and verify official domains directly through bookmarked links or official app stores. Organizations should block the domain and IP at the network level, while security teams should monitor for credential reuse across other services. Given the future-dated registration, additional domains from the same registrar or IP range should be scrutinized for similar credential harvesting activity.