buttsol[.]xyz

The domain buttsol.xyz was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently hosted behind Cloudflare (AS13335). It resolves to the IP address 172.67.164.43, which is located in the United States and served by the Cloudflare network. The authoritative nameservers are leo.ns.cloudflare.com and phoenix.ns.cloudflare.com, and the site is delivering content over HTTP/3 with a Google Trust Services / WE1 SSL certificate. The only visible page title returned by the server is "Nur einen Moment…", and the HTTP response code is 403, indicating that the server is intentionally denying direct access to the landing page.

Passive analysis classifies buttsol.xyz as a crypto‑related scam. The site is listed on one security blocklist and has been explicitly blocked by PhishDestroy. Independent scoring systems reflect extreme risk: Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports that 3 of 95 scanned security vendors have flagged the domain as malicious. The combination of a newly created domain, a low trust score, and active blocklist entries aligns with a high‑risk profile, consistent with the reported risk level of "high" and the active status of the infrastructure.

Open questions remain regarding the specific payload or social engineering tactics employed by the site, as the 403 response prevents direct observation of the phishing content. No additional infrastructure such as command‑and‑control servers, credential harvesting pages, or malware binaries have been observed in the available data. Defenders should therefore prioritize immediate containment: block buttsol.xyz at network perimeters, add the domain and its resolving IP to local deny lists, and monitor DNS queries for any related subdomains. Continuous re‑evaluation is advised, as further activity could surface additional indicators of compromise or expand the attack surface.