REGISTRAR NEGLIGENCE · EGREGIOUS Tucows Domains Inc. was notified 5 months ago — the threat is still operational.

Why this matters — ICANN RAA §3.18 obligation & victim-assistance

On 2026-02-08 18:29:20 UTC PhishDestroy delivered an evidence-backed abuse report (repeated 7 times, most recently 2026-02-08 18:29:20 UTC) to domainabuse@tucows.com with VirusTotal detections, urlscan capture, legal violations, and full screenshot evidence. More than 5 months later, the phishing infrastructure remains reachable .

Under ICANN RAA §3.18 accredited registrars are contractually obliged to “take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse.” Silence beyond 24 hours after a documented notification with verifiable evidence is not a timing issue — it is a policy decision to let the operation continue. PhishDestroy\'s position: where a registrar fails to act on clear evidence, the registrar has aligned itself with the operator of the scheme and bears co-responsibility for downstream harm caused to victims from the moment of notification onward.

Victim-assistance obligation. If Tucows Domains Inc. doesn't consider the listed detections enough proof — that is interesting in itself, given the volume of independent vendor confirmations. But after 7 separate notifications over 5 months, with the operation still active, the registrar took no measurable action to mitigate the harm caused by their client. The reasonable next step is direct help to any identified victims — contact & payment-trail disclosure, abuse-thread transcripts, registrant data preservation — since the registrar chose, by inaction, to extend the window of damage.

Elapsed since first report

5 months

Reports sent

Latest case ID

PD-1770575273-lucknight.com

Current status

Serving traffic (alive)

도메인 보안 및 위협 인텔리전스

lucknight[.]com

lucknight.com 피싱 및 보안 점검

“Lucknight | XXX”

위협 평결 심각 100/100 증거 점수

가용성 마지막으로 알려진 활성 현재 연결 가능성이 확인되지 않았습니다.

위험 신호

VirusTotal 탐지: 13/91 Spamhaus DBL: DBL_SPAM 브랜드 사칭: Genericcrypto 마지막으로 알려진 활성

13/91 VT URLQuery: 100 detections OTX: 1 pulse 2025년 12월 16일 2026년 3월 1일 이후 사용할 수 없음 Genericcrypto 도박 사기 Impersonation 7 Reports Sent CDN + more

위험 점수: 100점 만점에 100. 위험 수준: 심각.

보고서 요약

lucknight.com: VirusTotal 엔진 91개 중 13개가 이 도메인을 탐지했습니다. DNS, SSL, 등록기관, 차단 목록, 위협 정보를 확인하세요.

원본 포렌식 기록을 보존하기 위해 아래의 상세 PhishDestroy AI 분석은 영어로 유지됩니다.

Evidence Summary

CRITICAL

PhishDestroy first recorded lucknight.com on Dec 16, 2025. This English evidence brief is rebuilt from the current structured observations stored for the report. The current evidence score, computed from those stored observations, is 100/100.

The latest stored availability state is “Last known active” on Aug 2, 2026 at 00:29 UTC. No conclusive HTTP response is stored, so current availability remains unverified.

VirusTotal returned 13 detections from 91 scanners in the stored check on Aug 1, 2026 at 04:22 UTC. The independent blocklist snapshot recorded 0 matches across 10 configured external sources on Aug 2, 2026 at 00:20 UTC. PhishDestroy's own listing is excluded from that count. A zero-match snapshot is not a safety verdict.

Other stored evidence. Google Safe Browsing stored no positive flag on Mar 3, 2026 at 05:14 UTC. This time-bound result is not evidence of safety. AlienVault OTX stored 1 pulse reference on Mar 1, 2026 at 15:53 UTC. OTX pulses are community-intelligence references, not vendor verdicts. Spamhaus DBL stored the result DBL_SPAM on Jul 14, 2026 at 16:34 UTC. A URLScan capture is stored from Feb 26, 2026 at 02:19 UTC.

Stored context lists registrar Tucows Domains Inc., IP address 172.67.149.219, registration date Oct 21, 2025, apparent target Genericcrypto. Except for the registration date, these fields do not share a source timestamp in this report and may change.

Treat these as stored, time-bound observations rather than a live safety guarantee. Source verdicts and reachability can change, and zero or missing vendor matches never prove that a domain is safe. Avoid interacting with the domain while uncertainty remains, and use the appeal process if this report is inaccurate.

VirusTotal

13 det.

URLQuery

100 det.

OTX AlienVault

1 pulse

URLScan

Report ↗

TLS certificate

Expired or unverified -77d

연령

10 mo

Observed status

마지막으로 알려진 활성

DestroyList

Listed

Reports Sent

7 ignored

데이터 적용 범위 VirusTotal 13 / 91 URLQuery 100 det. OTX 1 pulse CF 레이더 clean URLScan capture 저장된 보고서 URLScan verdict malicious DNS 차단 확인되지 않음 TLS expired or unverified WHOIS 10 mo old Screenshot external capture 리디렉션 체인 조사되지 않음

위협 대응 Pipeline

Discovery

Checks

Reports

가용성

23/24

사전 탐색 및 수집

위협 탐지됨

1/1 ✓

위협 탐지됨

lucknight.com 탐지되어 전체 분석을 위해 대기열에 추가됨

2025년 12월 16일

Threat Intelligence Checks

URLScan.io Capture · URLScan Verdict · Cloudflare Radar · Web Archive · VirusTotal · Google Safe Browsing · OTX Threat Intel · Brand Impersonation · Forensic Evidence Collected · Technical Analysis Recorded · Site Came Back Online · Cloudflare Radar Scan · Content Observed Unavailable

13/13 ✓

URLScan.io Capture

Stored URLScan report with capture artifacts

2026년 2월 26일

URLScan Verdict

URLScan returned a malicious verdict · score 100

2026년 7월 29일

Cloudflare Radar

Scanned via Cloudflare Radar — DNS, 인증서 및 네트워크 데이터

Web Archive

Preserved in 웨이백 머신 — historical evidence archived

VirusTotal

13/91 recorded on VirusTotal

2026년 8월 1일

Google Safe Browsing

Checked via 구글 투명성 보고서

2026년 3월 3일

OTX Threat Intel

출처: 1 OTX pulse on AlienVault OTX

2026년 3월 1일

Brand Impersonation

Impersonation of Genericcrypto

Forensic Evidence Collected

Stored evidence from URLScan.io, stored screenshot

2026년 2월 26일

Technical Analysis Recorded

보고서에는 저장된 기술 또는 포렌식 분석 결과가 포함됩니다.

2026년 8월 2일

Site Came Back Online

Domain is responding again — monitoring resumed

2026년 8월 1일

Cloudflare Radar Scan

Cloudflare Radar로 스캔했습니다. 네트워크 분석이 완료되었습니다.

2026년 3월 7일

Content Observed Unavailable

모니터링에 사용할 수 없는 응답이 기록되었습니다. (HTTP 666); 원인은 독립적으로 확립되지 않았습니다.

2026년 3월 1일

Notification Records

Initial Abuse Report (#1) · ICANN Escalation #2 · ICANN Escalation #3 · ICANN Escalation #4 · ICANN Escalation #5 · ICANN Escalation #6 · ICANN Escalation #7 · 7 Reports Filed

8/8 ✓

Initial Abuse Report (#1)

Sent to 1 abuse contact at Tucows Domains Inc. with forensic evidence

domainabuse@tucows.com

2026년 2월 8일

ICANN Escalation #2

Escalation #2 sent to 3 recipients including ICANN Compliance — follow-up record after a previous report