buttcoin[.]foundation

This domain, buttcoin.foundation, is identified as a crypto drainer targeting users of the Buttcoin brand. The site presents itself as a legitimate Buttcoin-related platform, using the page title 'BUTTCOIN → 1 BTC Progress' to lure victims into connecting their cryptocurrency wallets. Once connected, the site is designed to drain funds by executing unauthorized transactions, a common tactic in crypto-focused phishing attacks. Users are tricked into believing they are engaging with a genuine progress tracker or reward system, increasing the likelihood of wallet exposure. Analysis indicates this domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 188.114.96.3 and is flagged by 8 out of 95 security vendors on VirusTotal. The domain appears on four security blocklists and has been blocked by multiple threat intelligence platforms. Technical indicators include the use of HSTS, Cloudflare, and HTTP/3, along with an SSL certificate issued by Google Trust Services. These elements suggest an attempt to mimic legitimate infrastructure while concealing malicious intent. If you visited buttcoin.foundation or interacted with its content, immediately disconnect any connected wallets from the site. Review recent transactions for unauthorized activity and revoke any suspicious wallet permissions using a trusted blockchain explorer. Consider transferring assets to a new wallet if compromise is suspected. Monitor accounts for unusual login attempts or transaction requests, and report the domain to relevant security communities to prevent further exploitation.