lunakai[.]net

This domain, lunakai.net, operates as a fraudulent cryptocurrency exchange platform specifically targeting Ethereum users. The site mimics legitimate exchange services, presenting itself under the page title 'Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | LunaKai' to deceive visitors into submitting wallet credentials or transferring funds to attacker-controlled addresses. The infrastructure is designed to exploit trust in well-known blockchain brands, with a focus on Ethereum, a primary target for financial theft in the cryptocurrency sector. Analysis indicates lunakai.net was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The domain resolves to IP address 104.21.65.53, hosted on AS13335 (Cloudflare, Inc.), a common proxy service used to obscure malicious infrastructure. Security vendors have flagged the domain on VirusTotal, with 18 out of 95 engines detecting it as malicious. Additionally, the domain appears on one security blocklist and is actively flagged by Google Safe Browsing as a phishing site. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as encryption is routinely exploited in phishing campaigns to appear legitimate. Users who have visited lunakai.net should immediately cease all interactions and avoid entering any credentials or financial details. If any sensitive information was submitted, affected parties should revoke access to associated cryptocurrency wallets, monitor for unauthorized transactions, and report the incident to relevant financial and cybersecurity authorities. Infrastructure analysis reveals the domain remains active as of this report, posing an ongoing risk to individuals engaging with Ethereum or other cryptocurrency services. Security teams are advised to block the domain and associated IP address within network defenses to prevent further exposure.