# buttcoinofficial.xyz — SUSPICIOUS

> Avoid buttcoinofficial.xyz as it impersonates Buttcoin and is flagged on multiple blocklists. The domain is currently offline but caution is advised.

## Summary
PhishDestroy identifies buttcoinofficial.xyz as a medium-risk brand impersonation threat targeting the Buttcoin brand. The domain was created recently and demonstrated behavior consistent with phishing or scam operations. Its risk level reflects moderate potential harm, primarily due to its impersonation of a niche cryptocurrency brand.

Supporting evidence includes the domain’s presence on three independent security blocklists and a partial detection by 3 of 95 VirusTotal vendors. The domain resolved to IP address 172.67.161.177 and was registered through NiceNIC International Group Co., Limited. The page title "Just a moment..." suggests use of intermediary or cloaking tactics typical of phishing attempts. These indicators together confirm the site’s malicious intent to deceive users by mimicking Buttcoin’s branding.

Currently, buttcoinofficial.xyz is offline, which limits immediate threat exposure. Users and organizations should remain vigilant against any future similar domains and avoid interacting with this or related URLs. Blocking the domain at network and endpoint levels is recommended, and ongoing monitoring for new impersonation attempts targeting Buttcoin remains advisable.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)
- Target brand: Buttcoin
- Page title: Just a moment...

## Domain Intelligence
- Registered: 2026-03-04 17:07:02
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 172.67.161.177
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ken.ns.cloudflare.com ollie.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 3 vendors flagged
  Vendors: ["Fortinet", "Gridinsoft", "Seclookup"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://i.ibb.co/wr3pC0SY/dfc428a90a7d.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/buttcoinofficial.xyz
- PhishDestroy: https://phishdestroy.io/domain/buttcoinofficial.xyz/
- LLM endpoint: https://phishdestroy.io/domain/buttcoinofficial.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/buttcoinofficial.xyz/
Last updated: 2026-03-19