lucialabs[.]lol

Analysis of lucialabs.lol indicates that the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on March 22, 2026. The site was served behind Cloudflare, using the nameservers june.ns.cloudflare.com and nikon.ns.cloudflare.com, and resolved to the IPv4 address 172.67.217.104, which is associated with Cloudflare, Inc. in Canada. The TLS certificate was issued by Let's Encrypt, confirming the use of a valid, publicly‑trusted certificate. Automated inspection on VirusTotal recorded six detections out of ninety‑four scanning engines, and the domain is listed on three public blocklists.

Independent blocklist providers PhishDestroy, MetaMask, and SEAL have also flagged the host. The page title returned by the HTTP request is “Just a moment…”, and the site employed Cloudflare Browser Insights, HTTP/3, and other Cloudflare‑provided technologies. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The current operational status is offline, suggesting the infrastructure has been taken down or is temporarily unavailable.

While the available data confirms the domain’s association with a generic phishing campaign, no additional content analysis, such as the specific lure or credential‑collection page, is present. Consequently, the precise target audience, credential types sought, and any potential payload remain undetermined. Defenders should continue to block traffic to 172.67.217.104, add lucialabs.lol to local deny lists, and monitor for any re‑registration or rapid DNS changes that might indicate a resurrection of the campaign. Ongoing surveillance of Cloudflare‑hosted infrastructure linked to the same IP range is recommended, as adversaries often reuse these resources for future malicious operations.