lunexorachub[.]net

Analysis of lunexorachub.net shows a newly registered domain created on February 26, 2026 that is actively hosting a counterfeit cryptocurrency trading portal. The site presents itself as “Lunexora – Crypto trading platform in Switzerland 2026” and purports to represent the legitimate brand “base”. The threat classification is brand impersonation with a fake exchange profile, and the risk level is marked as high. The domain resolves to the Cloudflare‑owned address 188.114.97.3, which belongs to AS13335 and is geolocated in the United States. It uses Cloudflare’s default nameservers, andronicus.ns.cloudflare.com and carla.ns.cloudflare.com, and does not present an SSL certificate, returning HTTP 200 over plain HTTP. Registration was performed through Sav.com, LLC. Security telemetry indicates that lunexorachub.net is listed on three public blocklists and has been flagged by at least one security vendor on VirusTotal (1/95 detections). The domain is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the assessment of a malicious impersonation campaign. The page content, combined with the absence of TLS and the use of a generic Cloudflare front‑end, is consistent with a fake exchange kit designed to harvest credentials from users seeking to trade base‑branded assets. Defenders should add lunexorachub.net to network and endpoint deny lists, monitor DNS queries for the associated Cloudflare IP range, and enforce TLS inspection to detect unencrypted traffic to the domain. Continuous threat‑intelligence feeds should be consulted for any emerging variants that reuse the same nameserver configuration or hosting infrastructure. Given the high‑risk rating, immediate remediation is advised to prevent credential compromise.