play[.]lurowin[.]com

Analysis of play.lurowin.com indicates active malicious activity consistent with a generic phishing campaign. The domain resolves to the IPv4 address 104.21.36.83, an address known to be part of a large content‑delivery network that frequently hosts compromised or abusive sites. VirusTotal reports that 14 out of 91 scanning engines have flagged the domain, confirming that multiple independent security products have observed suspicious behavior.

The domain is listed on a single security blocklist and has been explicitly blocked by PhishDestroy, a specialized anti‑phishing service, reinforcing its reputation as a phishing vector. No additional public intelligence—such as page title, SSL certificate details, or brand targeting—has been released, so the exact content served by the site remains unverified. Defenders should treat the domain as high‑confidence malicious: it should be added to network‑level deny lists, DNS filtering policies, and endpoint protection blocklists.

Continuous monitoring of DNS queries for the domain and its resolved IP is advised, as the underlying CDN may host other malicious payloads. Where possible, employ sandbox or URL‑reputation services to validate any future content delivered from this host before allowing user interaction. Incident response teams should also review any authentication or credential submissions that may have been directed to this domain, as phishing attempts often aim to harvest login details.