luntra-paycore[.]com

Analysis of luntra-paycore.com confirms it as a brand-impersonation phishing domain targeting users through fraudulent representation. The domain, registered on February 21, 2026, via NETIM SAS, presents itself as 'Luntra Paycore | Philippines’s Official Website 2025' in its page title, suggesting an attempt to mimic an official financial or payment service. Infrastructure analysis reveals the domain resolves to 45.9.148.137, an IP address hosted in the Netherlands under AS49447 (Nice IT Services Group Inc.), a network frequently associated with malicious activity. The absence of an SSL certificate further undermines its legitimacy, as modern secure sites universally employ encryption.

Detection data supports the malicious classification: the domain appears on one security blocklist, and two of 93 vendors on VirusTotal flagged it as malicious. The domain is currently offline, having been taken down following detection by PhishDestroy. Nameservers (ns1.netim.net, ns2.netim.net, ns3.netim.net) are consistent with the registrar but provide no additional legitimacy. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk assessment.

Defenders should treat this domain as confirmed phishing infrastructure. The combination of recent registration, brand-impersonation language in the page title, hosting on a high-risk ASN, and detection by security vendors provides sufficient evidence for blocking and takedown actions. No legitimate use case is evident, and the domain should be monitored for potential re-emergence under altered infrastructure or new registrations.