lumeproject[.]com

This domain, lumeproject.com, is flagged as a generic phishing site designed to harvest user credentials through deceptive web forms. Analysis indicates the site masquerades as a cultural or artistic project, leveraging the title 'Lume Project – ogni storia è illuminata' to target Italian-speaking users. No specific brand impersonation or cryptocurrency drainer kit signatures were identified, though the WordPress infrastructure suggests potential for credential theft via fake login portals or donation forms. Infrastructure analysis reveals the domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive domains. It resolves to the IP address 89.40.175.214, which has been linked to prior phishing activity. Detection metrics show 6 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one additional blocklist. The site employed Let's Encrypt SSL certificates, PHP, MySQL, and Google Analytics, indicating a structured but low-effort phishing operation. As of the latest assessment, lumeproject.com has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the domain remains registered, posing a residual risk of reactivation. Users who interacted with the site should assume credential exposure and initiate password resets on associated accounts. Organizations are advised to monitor for similar domains registered under the same registrar or resolving to the identified IP, as threat actors may reuse infrastructure for future campaigns.