bearcoin[.]cc

The domain bearcoin.cc was registered on February 21, 2026 through Porkbun LLC and is currently listed as taken offline. Analysis shows the site presented the page title "Bearcoin: Most Popular Online Crypto Casino Based on Blockchain," indicating an attempt to lure users with a cryptocurrency gambling proposition. The domain resolves to the IPv6 address 2a06:98c1:3121::3, which is hosted within the United States under AS13335, the Cloudflare network. Technical fingerprinting identified the use of Cloudflare services, including Cloudflare Browser Insights, as well as third‑party advertising and tracking components such as Twitter Ads and a Facebook Pixel.

The SSL certificate is identified as WE1, confirming the presence of HTTPS encryption. The site was blocked by the PhishDestroy blocklist and appears on one additional security blocklist, demonstrating that at least one reputable phishing mitigation service has taken action against it. VirusTotal scans recorded 12 positive detections out of 93 security vendors, reinforcing the malicious classification. Threat intelligence tags the activity as a "Crypto Scam" and attributes the underlying phishing kit to a "Gambler Scam" framework, which is commonly used to fabricate fake gambling or casino experiences to harvest credentials or payments.

While the domain is offline, the historical evidence suggests it was employed to target cryptocurrency users seeking online casino services. Defenders should continue to enforce network‑level blocks for bearcoin.cc, monitor related IPv6 ranges within the Cloudflare AS13335 space for similar activity, and update endpoint protection signatures to include the observed kit characteristics. Additional investigation into any residual DNS or TLS artifacts may reveal further command‑and‑control infrastructure, but the current data set provides sufficient confidence to classify bearcoin.cc as a confirmed crypto‑focused phishing operation.