bunnidesktop[.]xyz

The domain bunnidesktop.xyz was identified as a crypto drainer, a specific type of phishing threat designed to steal cryptocurrency assets by impersonating the legitimate Bunni Exchange platform, known as 'The Shapeshifting Exchange'. This domain is currently offline, indicating that it has been taken down or deactivated, likely due to security interventions. The phishing campaign targeted users seeking to interact with the Bunni protocol, luring them into connecting their wallets and ultimately draining their funds.

Analysis of the domain's technical indicators reveals that it resolves to the IP address 216.198.79.1 and is secured with a Let's Encrypt SSL certificate (R13), which is commonly abused by malicious actors due to its free availability. The domain was created on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar often associated with questionable domains. According to VirusTotal, the domain was flagged by 6 out of 95 security vendors, indicating moderate detection across the industry. Additionally, it appeared on 1 security blocklist, suggesting limited but existing recognition of its malicious nature. The page title matched the legitimate Bunni brand, further confirming the impersonation attempt.

As the domain is now offline, the immediate risk of interaction has been mitigated. However, users should remain vigilant against similar domains that may emerge, as threat actors frequently rotate infrastructure. PhishDestroy recommends avoiding any unsolicited links claiming to be Bunni Exchange, always verifying the official website URL, and never connecting wallets to unknown sites. If any credentials or wallet keys were entered on bunnidesktop.xyz, users should immediately transfer assets to a new wallet and enable two-factor authentication. Monitoring for suspicious transactions is also advised.