REGISTRAR NEGLIGENCE · EGREGIOUS Tucows Domains Inc. was notified 5 months ago — the threat is still operational.

Why this matters — ICANN RAA §3.18 obligation & victim-assistance

On 2026-02-08 18:29:20 UTC PhishDestroy delivered an evidence-backed abuse report (repeated 7 times, most recently 2026-02-08 18:29:20 UTC) to domainabuse@tucows.com with VirusTotal detections, urlscan capture, legal violations, and full screenshot evidence. More than 5 months later, the phishing infrastructure remains reachable .

Under ICANN RAA §3.18 accredited registrars are contractually obliged to “take reasonable and prompt steps to investigate and respond appropriately to any reports of abuse.” Silence beyond 24 hours after a documented notification with verifiable evidence is not a timing issue — it is a policy decision to let the operation continue. PhishDestroy\'s position: where a registrar fails to act on clear evidence, the registrar has aligned itself with the operator of the scheme and bears co-responsibility for downstream harm caused to victims from the moment of notification onward.

Victim-assistance obligation. If Tucows Domains Inc. doesn't consider the listed detections enough proof — that is interesting in itself, given the volume of independent vendor confirmations. But after 7 separate notifications over 5 months, with the operation still active, the registrar took no measurable action to mitigate the harm caused by their client. The reasonable next step is direct help to any identified victims — contact & payment-trail disclosure, abuse-thread transcripts, registrant data preservation — since the registrar chose, by inaction, to extend the window of damage.

Elapsed since first report

5 months

Reports sent

Latest case ID

PD-1770575273-lucknight.com

Current status

Serving traffic (alive)

lucknight[.]com

Etki Alanı Güvenliği ve Tehdit İstihbaratı Raporu

“Lucknight | XXX”

13/91 VT URLQuery: 100 OTX: 1 pulse Unverified Dec 16, 2025 Unavailable since Mar 01, 2026 Genericcrypto Kumar Dolandırıcılığı Impersonation 7 Reports Sent CDN + more

93 Risk Puanı

Yerelleştirilmiş rapor özeti

lucknight.com: VirusTotal üzerinde 13/91 tespit. DNS, SSL, kayıt kuruluşu, engel listeleri ve tehdit kanıtlarını inceleyin.

Özgün adli kaydı korumak için aşağıdaki ayrıntılı PhishDestroy AI analizi İngilizce bırakılmıştır.

PhishDestroy AI

HIGH

The domain lucknight[.]com presents itself as "Lucknight | XXX," indicating a potential adult entertainment or gambling-related service. Based on the high detection rate and security flags, this site likely poses a threat as a malicious or fraudulent platform, possibly used for phishing, malware distribution, or scam operations. The exact nature of the threat is not specified in the data, but the widespread security vendor flags suggest it is unsafe for users.

Technical evidence shows the site was flagged by 16 out of 95 VirusTotal vendors, including ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, and CyRadar. It appears on one blocklist. The domain was registered through Tucows Domains Inc. and created on 2025-10-21. Its IP address is 172.67.149.219, located in the United States and hosted by AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services / WE1, and nameservers are marissa.ns.cloudflare.com and alaric.ns.cloudflare.com.

Currently, the site is down or offline, indicating it may have been taken down or is temporarily inaccessible. The risk level is high due to the significant number of security vendor detections and its presence on blocklists. Users should avoid any interaction with this domain or related resources.

VirusTotal

13 det.

URLQuery

100 det.

OTX AlienVault

1 pulse

URLScan

Report ↗

Yaş

9 mo

Observed status

Last known active

DestroyList

Listed

Reports Sent

7 ignored

Veri kapsamı VirusTotal 13 / 91 URLQuery 100 det. OTX 1 pulse CF Radar clean URLScan report ready DNS engellemeleri none SSL no cert WHOIS 9 mo old Screenshot yakalanmadı Yönlendirme zinciri not probed

Tehdit Müdahale Pipeline

Discovery

Checks

Reports

Availability

22/23

Önleyici Keşif ve Veri Alımı

Tehdit Alındı

1/1 ✓

Tehdit Alındı

lucknight.com tespit edildi ve kapsamlı analiz için sıraya alındı

Dec 16, 2025

Threat Intelligence Checks

URLScan.io Snapshot · Cloudflare Radar · Web Archive · VirusTotal · Google Safe Browsing · OTX Threat Intel · Brand Impersonation · Forensic Evidence Collected · Technical Analysis Recorded · Site Came Back Online · Cloudflare Radar Scan · Content Observed Unavailable

12/12 ✓

URLScan.io Snapshot

Submitted to urlscan.io — screenshot, DOM & HTTP transactions captured

Feb 26, 2026

Cloudflare Radar

Scanned via Cloudflare Radar — DNS, certificates & network data

Web Archive

Preserved in Wayback Machine — historical evidence archived

VirusTotal

13 / 91 vendors flagged on VirusTotal

Aug 01, 2026

Google Safe Browsing

Checked via Google Şeffaflık Raporu

Mar 03, 2026

OTX Threat Intel

Şu kaynakta bulunur: 1 OTX pulse on AlienVault OTX

Mar 01, 2026

Brand Impersonation

Impersonation of Genericcrypto

Forensic Evidence Collected

Stored evidence from URLScan.io, stored screenshot

Feb 26, 2026

Technical Analysis Recorded

The report contains stored technology or forensic-analysis results

Aug 01, 2026

Site Came Back Online

Domain is responding again — monitoring resumed

Aug 01, 2026

Cloudflare Radar Scan

Scanned via Cloudflare Radar — network analysis completed

Mar 07, 2026

Content Observed Unavailable

Monitoring recorded an unavailable response (HTTP 666); the cause was not independently established

Mar 01, 2026

Notification Records

Initial Abuse Report (#1) · ICANN Escalation #2 · ICANN Escalation #3 · ICANN Escalation #4 · ICANN Escalation #5 · ICANN Escalation #6 · ICANN Escalation #7 · 7 Reports Filed

8/8 ✓

Initial Abuse Report (#1)

Sent to 1 abuse contact at Tucows Domains Inc. with forensic evidence

domainabuse@tucows.com

Feb 08, 2026

ICANN Escalation #2

Escalation #2 sent to 3 recipients including ICANN Compliance — follow-up record after a previous report