buttcoineth[.]vip

The domain buttcoineth.vip is currently active and hosts a web page titled “Buttcoin | ETH”. It was registered on August 29 2025 through NameCheap, Inc. and resolves to the IP address 63.250.38.111, which is advertised as belonging to AS22612 (Namecheap, Inc.) and located in the United States. The authoritative nameservers are dns1.namecheaphosting.com and dns2.namecheaphosting.com. The site presents a valid TLS certificate issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 chain. HTTP requests return status 200 and the page is built with Webflow, LiteSpeed, Cloudflare, Twitter widgets, jQuery CDN, Google Hosted Libraries and Google Font API. The infrastructure has been flagged by PhishDestroy and appears on one security blocklist. Gridinsoft assigns a trust score of 0/100, and five of ninety‑five VirusTotal scanners have marked the domain as malicious. The content is classified as a crypto scam that impersonates Binance, indicating a high‑risk brand‑impersonation campaign. While the exact phishing flow and credential‑capture mechanisms have not been publicly disclosed, the combination of a trusted SSL certificate, reputable hosting, and active blocklist listings suggests an operational threat. Defenders should add 63.250.38.111 and buttcoineth.vip to URL filtering and intrusion‑prevention rules, monitor DNS queries for the domain’s nameservers, and enforce multi‑factor authentication for Binance‑related accounts to mitigate credential compromise. Continuous threat‑intel feeds should be consulted for any updates to the malicious payload or associated command‑and‑control hosts.