lunero[.]shop

Analysis of lunero.shop as of July 23, 2026 shows a high‑risk generic phishing infrastructure that remains active. The domain was registered on February 21, 2026 through Namecheap, Inc. and uses the registrar‑provided nameservers dns101.registrar-servers.com and dns102.registrar-servers.com. DNS resolution points to IP address 94.154.172.100, which is assigned to AS209101 (IP Vendetta Inc.) and geolocated to the Netherlands. An SSL certificate identified as R13 is present, but the HTTP response returns a 403 status code and the page title is recorded as "404 Not Found," indicating that the site is deliberately restricting access or serving error pages to casual visitors.

Threat intelligence signals reinforce the malicious classification: the domain appears on one security blocklist and is actively blocked by PhishDestroy. AlienVault OTX includes the domain in a single threat pulse, and VirusTotal reports that 14 of 93 scanned security vendors flag the domain as malicious. These independent detections converge on a consistent view of lunero.shop as a phishing vector.

While the exact payload or credential‑harvesting page has not been captured, the combination of registrar abuse, dedicated hosting, a restricted HTTP response, and multiple vendor detections provides sufficient confidence to treat the domain as compromised. Defenders should add lunero.shop to network and endpoint blocklists, monitor DNS queries for the associated IP and nameservers, and consider sinkholing the IP range if feasible. Ongoing surveillance of the domain’s DNS records and any changes in detection counts is recommended to capture potential escalation or re‑hosting attempts.