luckylukebet[.]life

The domain luckylukebet.life was registered on May 03, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently hosted behind Cloudflare’s network (IP 104.21.33.54, located in Canada). The site presents a valid Let’s Encrypt certificate issued by the E7 intermediate, indicating a correctly configured TLS endpoint, but the HTTP response is a 403 status, suggesting restricted or filtered access.

Reputation services show strong adverse signals: VirusTotal records 12 out of 95 security vendors flagging the domain, Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single known security blocklist. PhishDestroy has already blocked the domain, and AlienVault OTX lists it in one threat‑intelligence pulse, reinforcing the view that the domain is being leveraged for malicious activity.

Infrastructure analysis reveals the domain resolves to the Cloudflare‑provided IP address 104.21.33.54, with authoritative nameservers carlos.ns.cloudflare.com and carioca.ns.cloudflare.com. Mail exchange is routed through route2.mx.cloudflare.net (priority 9), indicating reliance on Cloudflare’s email relay services. The combination of a recent registration, Cloudflare front‑end, and a forced 403 response is consistent with a fast‑flux or abuse‑by‑proxy deployment often seen in phishing campaigns.

Defenders should prioritize immediate blocking of luckylukebet.life at perimeter and DNS layers, and monitor for any related sub‑domains or CNAME records that may be created under the same registrar. Continuous scanning of the IP address and associated Cloudflare zones is advised, as the underlying host may serve additional malicious payloads. Because the page content has not been publicly analyzed, further investigation of the site’s response payloads and any credential‑harvesting endpoints is necessary to fully assess the threat scope.