lunocasino[.]xyz

This domain, lunocasino.xyz, is identified as a brand impersonation threat specifically targeting Base, a well-known cryptocurrency platform. The site is designed to deceive users into believing they are interacting with an official Base service, potentially leading to unauthorized access to sensitive credentials or digital assets. The threat actor likely aims to exploit trust in the Base brand to facilitate fraudulent transactions or data exfiltration, a tactic commonly observed in crypto-focused phishing campaigns. Infrastructure analysis reveals multiple indicators of malicious activity. The domain was registered on April 24, 2026, through FewMoreTaps OÜ, a registrar frequently associated with suspicious domains. It resolves to the IP address 188.114.97.3 and is flagged by 10 out of 95 security vendors on VirusTotal, including detections for brand impersonation and phishing. The domain appears on one security blocklist and is linked to a single threat intelligence pulse in AlienVault OTX. Additionally, the SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. Users who have visited lunocasino.xyz or interacted with its content are advised to take immediate action. First, revoke any permissions granted to the site within cryptocurrency wallets or associated applications. Second, monitor all linked accounts for unauthorized transactions or suspicious activity, particularly those tied to Base or other crypto platforms. If credentials were entered, reset passwords and enable multi-factor authentication on all critical accounts. Finally, consider reporting the incident to relevant cybersecurity organizations to contribute to broader threat intelligence efforts.