maya[.]solfun[.]us

Analysis of maya.solfun.us shows a newly created (25 February 2026) domain hosted behind Cloudflare infrastructure (ASN 13335, IP 104.21.92.112, United States). The domain is delegated to Cloudflare name servers (ezra.ns.cloudflare.com, jocelyn.ns.cloudflare.com) and does not present an SSL/TLS certificate, indicating that any web service would be delivered over plain HTTP. The only observable page attribute is the title "The Voter Dog Airdrop," which aligns with the reported crypto‑scam classification and the identified "Airdrop Scam" phishing kit. Registration was performed through Dynadot LLC. Security telemetry indicates that the site was flagged by two vendor blocklists and actively blocked by PhishDestroy and ScamSniffer.

VirusTotal scans recorded 2 of 93 security vendors marking the domain as malicious, reinforcing the suspicion of malicious intent. The domain currently appears offline, but historical evidence confirms its use for a crypto‑airdrop lure. Defenders should add maya.solfun.us to domain deny lists, enforce DNS sinkholing, and monitor for any re‑registration or resurgence of the same host‑header patterns.

Continuous observation of Cloudflare‑origin IPs associated with this domain is advised, as threat actors often reuse the same edge network for new campaigns. The lack of TLS and the brief lifespan suggest a throwaway infrastructure designed for a single‑shot phishing operation. Until further content is captured, the precise mechanisms of credential or token theft remain unknown, but the existing indicators are sufficient to justify proactive blocking and alerting of end‑users.