dftrg[.]lol

This report analyzes the domain dftrg.lol, which presented a page titled "Lumia | HyperNodes." The site purports to be related to "Lumia" and "HyperNodes," which suggests it is likely a fraudulent portal designed to impersonate a legitimate cryptocurrency or blockchain node service. The primary threat posed by this domain is credential theft and financial fraud, as users may be tricked into providing login credentials or connecting digital wallets under the false pretense of managing node operations or staking assets.

Technical analysis reveals significant red flags. VirusTotal reports detections from 7 out of 95 vendors, specifically flagged by alphaMountain.ai, CyRadar, Fortinet, G-Data, and Gridinsoft. The domain is also listed on 4 blocklists. The domain was registered on 2026-02-21 through NiceNIC International Group Co., Limited, a registrar often associated with high-risk domains. The IP address 172.67.170.158 is hosted in the United States under AS13335 Cloudflare, Inc., and the nameservers are robin.ns.cloudflare.com and zeus.ns.cloudflare.com. Critically, no SSL certificate was detected, meaning any data transmitted to the site would be unencrypted.

The domain is currently down or offline, which prevents active exploitation. However, the risk level remains high due to the combination of recent registration, use of a known high-risk registrar, lack of encryption, and multiple security vendor detections. The site likely poses a significant threat if it becomes active again, as it is designed to deceive users into compromising their cryptocurrency assets.