butorix[.]com

The domain butorix.com was registered on 2025-09-23 through NiceNIC International Group Co., Limited and currently resolves to the Cloudflare‑owned address 188.114.97.3 (AS13335, United States). The site presents the page title “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | BUTORIX”, which aligns with a cryptocurrency‑focused landing page, and it is classified as a social media phishing campaign that impersonates the Ethereum brand. Infrastructure analysis shows the domain is protected by Cloudflare, using an SSL certificate issued by Google Trust Services under the WE1 designation, and the authoritative name servers are mina.ns.cloudflare.com and sid.ns.cloudflare.com.

HTTP requests return a 403 status, indicating the site is presently taken offline. Reputation data include a Gridinsoft trust score of 0/100 and placement on one external blocklist; PhishDestroy has already blocked the domain. VirusTotal reports three positive detections out of ninety‑five scanners, confirming malicious activity.

Defenders should add butorix.com to URL filtering and sinkhole lists, monitor for any resurrection of the address, and enforce TLS inspection to capture any future traffic. Continuous observation of the associated IP and Cloudflare nameserver activity is recommended to detect potential reuse of the infrastructure for other impersonation campaigns. The evidence base is limited to the observed metadata; the actual page content has not been examined, so further forensic capture would be required to detail the phishing payload.