buttholewinn[.]pages[.]dev

This domain, buttholewinn.pages.dev, is flagged as a high-severity brand_impersonation threat targeting the Across protocol. The site presents a fraudulent sBTC Rewards Program, using social engineering to trick users into connecting wallets to a crypto drainer. Analysis of the page title, "sBTC Rewards Program - Earn Bitcoin - Explore Ecosystem," confirms the impersonation of Across’s legitimate reward campaigns, likely designed to execute unauthorized token transfers upon wallet interaction. Infrastructure analysis reveals the following technical indicators: VirusTotal detection score of 2/95 security vendors, registration through Cloudflare, Inc., resolution to IP 172.66.47.178 (AS13335, US), and domain creation on March 17, 2025. The domain appears on 2 security blocklists, including PhishDestroy and ScamSniffer, and is secured with a Google Trust Services SSL certificate (WE1). No Google Safe Browsing (GSB) flags were observed at the time of analysis. The domain remains active as of this report, with no takedown or sinkholing observed. Users are advised to block the domain and IP at the network level, revoke any wallet permissions granted to the site, and monitor for unauthorized transactions. Given the persistence of the infrastructure on Cloudflare’s network, continued vigilance is recommended, particularly for users who may have interacted with the fraudulent rewards program prior to detection.