lumain[.]gg

Analysis of lumain.gg indicates that the domain is currently taken offline but exhibits multiple indicators typical of a phishing infrastructure. The site resolved to the IP address 172.67.163.195, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. DNS resolution used Cloudflare nameservers (kianchau.ns.cloudflare.com and leia.ns.cloudflare.com), confirming the hosting provider. The web service employed Cloudflare’s edge platform with HTTP/3 enabled and presented an SSL certificate issued by Google Trust Services under the WE1 designation, a common certificate for Cloudflare‑proxied sites.

Page metadata revealed the title "Sharper Communication — Closer Connections | Lumain," suggesting the domain attempts to masquerade as a legitimate Lumain communication portal, although the exact content of the page has not been examined. VirusTotal records show that two of ninety‑five scanned security vendors flagged the domain, providing limited but notable detection. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. Registration details indicate the domain was purchased through NameCheap, Inc., a registrar frequently used by malicious actors for rapid provisioning.

Uncertainty remains regarding the specific phishing payload, credential‑capture mechanisms, or any associated command‑and‑control infrastructure, as no additional artifacts such as URLs, email templates, or malware hashes have been disclosed. Defenders should continue to monitor the IP address 172.67.163.195 for any re‑use, enforce blocking of the domain at network perimeters, and update URL filtering policies to include lumain.gg. Threat‑intel teams should also query passive DNS and SSL‑certificate transparency logs for related subdomains or future registrations that may reuse the same infrastructure.