buttcoin[.]droponsol[.]fun

This domain, buttcoin.droponsol.fun, is flagged as a generic phishing threat and is currently under active investigation. The domain was registered on July 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar sometimes associated with lower-scrutiny registrations. It resolves to the IP address 172.67.180.213, which is part of Cloudflare's hosting infrastructure, providing CDN and DDoS protection that can obscure the true origin server. The domain uses Cloudflare nameservers (galilea.ns.cloudflare.com and moura.ns.cloudflare.com).

VirusTotal scanned this domain with 91 vendors, and as of the report date, zero vendors flagged it as malicious. However, the absence of detections is not proof that the domain is safe, as new threats may not yet be catalogued. The domain appears on one security blocklist, specifically PhishDestroy, which has classified it as a threat. Google Safe Browsing and AlienVault OTX status are not provided in the intelligence, so their positions are unknown.

The exact content of the page has not been analysed, and no specific brand, scam type, or page title is available in the supplied data. Defenders should treat this domain as suspicious due to its recent registration, registrar profile, and blocklist presence. Recommended actions include blocking the domain at the DNS or proxy level, monitoring for any associated phishing kits or credential harvesting activity, and re-scanning periodically as threat intelligence updates. Users should be warned not to interact with the domain until a full content analysis is completed.