bexira-luno[.]net

This domain, bexira-luno.net, poses a targeted brand impersonation threat against Binance users under the guise of "KI-Trading Deutschland 2026." The site presents itself as an artificial intelligence-based trading platform, likely designed to harvest cryptocurrency wallet credentials or deploy crypto-draining malware. The page title, "Bexira Lunos™ - KI-Trading Deutschland 2026," mimics legitimate trading service branding while incorporating localized German-language elements to increase credibility among specific user demographics. Analysis indicates the domain was structured to exploit trust in both Binance and emerging AI-driven trading tools, a common tactic in cryptocurrency phishing campaigns. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to the IP address 188.114.97.3 and has been flagged by 6 out of 95 security vendors on VirusTotal. It was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing domains. The domain appears on three security blocklists and is actively blocked by cryptocurrency wallet protection systems. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. Users who accessed bexira-luno.net should immediately revoke any connected wallet permissions and transfer assets to a new, secure wallet. All credentials entered on the site should be considered compromised and reset across all platforms. Monitor transaction histories for unauthorized activity, particularly focusing on smart contract interactions or token approvals. If crypto-draining malware is suspected, disconnect the device from all networks and perform a full system scan using updated security tools. Report the incident to relevant cryptocurrency security response teams for further mitigation.