lunexapp[.]pages[.]dev

This domain is under investigation for hosting a cryptocurrency presale phishing scheme targeting users of the Lunex Network. Analysis indicates the infrastructure is designed to impersonate a legitimate token presale event, a common tactic to harvest wallet credentials and private keys from unsuspecting investors. Infrastructure analysis reveals the domain lunexapp.pages.dev was registered through Cloudflare Pages on July 17, 2025, and currently resolves to the IP address 188.114.97.3. The page title, 'Lunex Network | Presale Live,' directly references the targeted project. Despite its recent creation, the domain appears on one security blocklist (PhishDestroy) and maintains a valid SSL certificate issued by Google Trust Services (WE1). VirusTotal reports zero detections across 95 engines, suggesting the threat may still be undetected by most security vendors. Mitigation steps for this specific threat type include blocking the domain and IP at the network perimeter, particularly in environments where cryptocurrency transactions occur. Organizations should monitor for internal traffic to 188.114.97.3 and lunexapp.pages.dev, as these may indicate compromised credentials or attempted fraud. Users should be educated to verify presale authenticity through official project channels only, as phishing pages often mimic legitimate branding with high fidelity. Given the zero-detection status on VirusTotal, manual inspection of the site's code may be required to confirm malicious intent, focusing on wallet address substitution patterns and JavaScript keyloggers.