buttcoin[.]claim-portal[.]fun

The domain buttcoin.claim-portal.fun was registered on July 21, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 172.67.161.107. Its authoritative nameservers are stella.ns.cloudflare.com and tate.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare’s edge network. A VirusTotal scan performed on the domain was processed by 91 independent vendors; none of the vendors reported a detection at the time of scanning. While the absence of detections does not constitute a safety guarantee, it does provide a baseline reference for future comparative analysis.

The domain is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, suggesting that at least one external threat‑intelligence source has correlated the domain with malicious activity. The threat type associated with the domain is classified as a crypto drainer, implying that any interaction with the site may attempt to illicitly transfer cryptocurrency assets from compromised victims. No public SSL certificate details, HTTP status codes, page title, or Safe Browsing verdicts are available in the current intelligence set, leaving those vectors unverified. Likewise, there are no observable references to OTX identifiers or additional blocklist entries beyond the single source already noted.

Defenders should continue to enforce outbound network controls that restrict connections to the IP 172.67.161.107 and to any domain matching the pattern *.claim-portal.fun. Endpoint protection solutions should be updated to include the domain in block or deny lists, and security monitoring should be tuned to alert on DNS queries or HTTP requests targeting this host. Continuous re‑scanning with multi‑vendor services such as VirusTotal is recommended to capture any future changes in the domain’s behavior.