lume-mail[.]org

PhishDestroy identifies lume-mail.org as an active crypto wallet credential drainer site currently under investigation for phishing. The domain exhibits classic drainer kit characteristics including social engineering lures targeting cryptocurrency users and potential exploitation of browser wallet extensions. While specific drainer kit signatures are still being analyzed, the domain's pattern of operation strongly suggests credential harvesting functionality targeting MetaMask and similar wallet users. Brand impersonation analysis shows no direct impersonation of major cryptocurrency brands, suggesting a more generic wallet-draining operation.

Technical forensic analysis reveals exact threat indicators: VirusTotal shows 2/95 detection score with no security products currently flagging the payload, PDR Ltd. d/b/a PublicDomainRegistry.com as registrar, resolving to IP 188.114.96.3, domain creation date of April 17, 2026, Let's Encrypt SSL certificate, flagged by Google Safe Browsing (GSB), and listed on 2 security blocklists including MetaMask and SEAL detection systems. The domain's recent creation date combined with active blocking by major security platforms indicates a newly deployed threat infrastructure.

Current operational status shows lume-mail.org remains active despite security blocks from MetaMask and SEAL. The site continues to resolve and may be serving malicious payloads to unaware visitors. Response actions include ongoing monitoring by security researchers and continued blocklist propagation. Remaining risk assessment indicates medium-high threat potential due to the domain's recent deployment, lack of current AV detection, and active credential harvesting capabilities targeting cryptocurrency users. Users are advised to avoid this domain entirely and report any suspicious wallet connection requests to their respective wallet providers immediately.