lumixcapitals[.]com

Analysis of lumixcapitals.com indicates that the domain was used to host a brand‑impersonation campaign targeting the Avalanche brand, as reflected in the extracted page title “TradeX” and the explicit indication of impersonation. The domain resolves to IP address 31.97.44.38, which is allocated to Hostinger International Limited in Germany (AS47583). No TLS certificate is present, meaning the site was served over plain HTTP. Registration records show the domain was created on September 08, 2025 through Tucows Domains Inc., and it leverages Cloudflare nameservers camilo.ns.cloudflare.com and chan.ns.cloudflare.com.

Reputation scoring from Gridinsoft assigns a low trust value of 14 out of 100, and the domain is listed on a single security blocklist. Independent scanning on VirusTotal recorded detections from two of ninety‑five antivirus engines, confirming that at least a minority of scanners flagged the site as malicious. PhishDestroy has already taken the domain offline, and the current status is reported as offline, suggesting the active phishing page is no longer reachable. However, the historical footprint—IP ownership, lack of SSL, low trust score, and vendor detections—provides sufficient evidence to classify the infrastructure as a confirmed phishing asset.

Defenders should continue to block lumixcapitals.com at network perimeter and DNS layers, monitor the hosting IP 31.97.44.38 for any re‑use, and add the domain to internal blocklists. Given the recent creation date, threat actors may recycle similar domains, so security teams should watch for newly registered domains using the same registrar or nameserver pattern. Ongoing vigilance is advised to detect any resurgence of the Avalanche impersonation campaign.