luckyhash[.]app

The domain luckyhash.app is associated with a credential theft threat. It impersonates the brand HashFlip, potentially to deceive users into revealing their login credentials. No specific drainer kit has been identified, but the domain exhibits multiple red flags that indicate a high risk of malicious activity.

Analysis indicates that the domain has a VirusTotal score of 5/95, suggesting that a significant number of security vendors have flagged it as malicious. The domain is registered through NiceNIC International Group Co., Limited and resolves to the IP address 188.114.96.3. Created on February 22, 2026, it has been flagged on one security blocklist. The Gridinsoft trust score is 0/100, indicating a complete lack of trustworthiness. The domain uses a Let's Encrypt SSL certificate and employs technologies such as Node.js, Socket.io, HSTS, Google Analytics, and Cloudflare Browser Insights. Cloudflare and HTTP/3 are also detected.

Currently, the domain is offline, which may indicate that it has been taken down or is temporarily inactive. Despite this, the risk remains elevated due to the historical presence of credential theft indicators. Users are advised to avoid visiting the domain and to remain vigilant for any attempts to revive or redirect it. Security teams should monitor for any reactivation and continue to block the domain to prevent potential data breaches.