dexluma[.]com

Analysis of the domain dexluma.com indicates a brand impersonation campaign targeting Ethereum users, classified as an elevated-risk crypto scam. The domain was registered on November 20, 2025, through Web Commerce Communications Limited, a registrar frequently associated with fraudulent infrastructure. As of July 24, 2026, the site is offline, though prior activity has been documented. The domain resolves to IP address 188.114.96.3, hosted on Cloudflare's network (AS13335), with nameservers novalee.ns.cloudflare.com and rocco.ns.cloudflare.com, a configuration commonly observed in phishing operations leveraging Cloudflare's proxy services to obscure origin servers.

Detection metrics reveal limited but consistent flagging: eight of ninety-five security vendors on VirusTotal identified the domain as malicious, while Google Safe Browsing explicitly classifies it as engaging in social engineering. The domain appears on a single security blocklist, and trust scores from Scamadviser and Gridinsoft both assign a 1/100 and 0/100 rating, respectively, further corroborating its fraudulent nature. No SSL certificate was detected, increasing the likelihood of interception risks for any residual traffic. The page title, 'Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Dexluma,' directly aligns with the impersonation of a cryptocurrency exchange platform, a tactic used to deceive users into depositing funds or disclosing wallet credentials.

While the exact content of the site remains unanalyzed, the combination of registration patterns, hosting infrastructure, detection flags, and explicit branding signals a deliberate attempt to exploit Ethereum's reputation. Defenders are advised to block the domain at the DNS and proxy levels, monitor for related domains registered through the same registrar, and alert users to the social engineering risks associated with cryptocurrency-themed impersonation sites.