etherbutts[.]wtf

The domain etherbutts.wtf was registered on February 21, 2026 through NameCheap, Inc. and uses the authoritative servers dns1.registrar-servers.com and dns2.registrar-servers.com. DNS resolution points to IP address 64.29.17.1, which belongs to AS16509 Amazon.com, Inc. and is geolocated in the United States. Hosting technology is identified as Vercel with HTTP Strict Transport Security (HSTS) enabled, and the site presents a TLS certificate issued by Let’s Encrypt (R12). HTTP response codes include a 307 temporary redirect and a page title of "404: NOT_FOUND," indicating that the landing page currently does not deliver content. The domain is classified as a crypto‑related scam and is flagged as high‑risk and active. Security telemetry shows the domain is listed on three blocklists, has been blocked by PhishDestroy, MetaMask, and SEAL, and Google Safe Browsing reports it as a social‑engineering threat. VirusTotal analysis records four detections out of ninety‑three scanning engines, and Gridinsoft assigns a trust score of zero out of one hundred. Defenders should add etherbutts.wtf to deny‑list and URL filtering policies, monitor for any new resolution or infrastructure changes, and enforce strict outbound controls for cryptocurrency transaction attempts originating from compromised endpoints. Continuous observation of the domain’s DNS and hosting attributes is advised to detect potential re‑hosting or evasion tactics.