register-bunnie-sol[.]xyz

This domain, register-bunnie-sol.xyz, is an active phishing site designed to impersonate the Solana blockchain platform. The site likely presents itself as a legitimate Solana-related service, such as a wallet recovery tool, token airdrop, or staking portal, to trick users into entering their private keys, seed phrases, or wallet credentials. Once obtained, these sensitive details are used by attackers to drain cryptocurrency assets from victims' wallets. The site may also distribute malicious browser extensions or desktop applications disguised as official Solana tools, further compromising user security and financial assets. Analysis indicates this domain poses a credible and elevated threat based on multiple technical indicators. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with fraudulent domains. It resolves to the IP address 104.21.37.160 and is protected by Cloudflare, a common tactic used to obscure hosting origins and evade takedowns. The page title, 'Just a moment...', is characteristic of Cloudflare's interstitial challenge pages, suggesting the site is actively filtering traffic. Most critically, the domain is flagged by 6 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist, confirming its malicious classification. Users who have visited register-bunnie-sol.xyz or interacted with its content should take immediate action to mitigate risk. First, disconnect any devices used to access the site from the internet and run a full antivirus scan to detect potential malware. If any wallet credentials, seed phrases, or private keys were entered, transfer all assets to a new, secure wallet immediately, as the compromised credentials are likely already exposed. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where possible. Report the incident to relevant blockchain security teams and consider notifying local cybercrime authorities. Avoid clicking on any links or downloading files from unsolicited messages, even if they appear to come from official sources, as attackers may follow up with additional phishing attempts.