bunniextension[.]xyz

Analysis of bunniextension.xyz demonstrates a short‑lived phishing infrastructure registered on 21 February 2026 through NiceNIC International Group Co., Limited. The authoritative nameservers ns1.vercel-dns.com and ns2.vercel-dns.com resolve the domain to 216.198.79.65, an IP address belonging to Amazon.com, Inc. (AS16509) located in the United States. The site presented a TLS certificate issued by Let’s Encrypt (R12) and employed HSTS, indicating a modern HTTPS deployment. HTTP responses returned status code 451, suggesting the content was unavailable at the time of observation.

Vercel is identified as the hosting platform, corroborated by the detected technologies. On VirusTotal the domain was flagged by 7 of 93 security vendors, and it appears on a single external blocklist; PhishDestroy explicitly blocks the domain. The page title “Bunni – The Shapeshifting Exchange” is recorded, but no further content analysis is available. Current status is offline, yet the combination of a recent registration, Amazon‑hosted IP, valid TLS, and multiple vendor detections indicates a purposeful phishing campaign aimed at users of the “Bunni” exchange service.

Defensive actions should include adding 216.198.79.65 to network deny lists, monitoring DNS queries for the domain and its Vercel nameservers, and ensuring that endpoint protection solutions incorporate the VirusTotal detection count. Organizations that recognize the “Bunni” brand should educate users about unsolicited login prompts and enforce multi‑factor authentication. Continuous observation of the registrar NiceNIC and any re‑registration attempts is recommended, as threat actors may recycle the same brand‑focused naming pattern.