register-buttbear[.]fun

The domain register-buttbear.fun was registered on February 21, 2026 and is currently taken offline. Infrastructure analysis shows it resolves to the IP address 172.67.197.73, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented an SSL certificate identified as WE1, indicating a valid TLS layer was in place while the site was active. Page metadata revealed the title "BUTT BEAR | Airdrop," aligning with the known phishing kit classified as an Airdrop Scam that impersonates the Solana brand.

Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting a severely malicious profile. The domain has been added to at least one security blocklist and was actively blocked by the PhishDestroy mitigation service. VirusTotal scans recorded two detections out of ninety-three participating security vendors, confirming that multiple independent engines flagged the domain as malicious.

Although the site is now offline, defenders should continue to monitor the associated IP address for any resurgence of malicious activity, enforce blocklisting of the domain and its IP in perimeter defenses, and ensure that any inbound traffic to Cloudflare‑owned ranges is inspected for similar brand‑impersonation patterns. Organizations that interact with Solana‑related services should educate users about unsolicited airdrop offers and enforce strict verification of URLs before providing credentials or wallet information. Ongoing threat‑intel feeds should be consulted for any re‑use of the same certificate fingerprint or page title in new campaigns, as the observed indicators suggest a reusable phishing kit targeting cryptocurrency communities.