Is event-buttcoin.com a scam? TrustSniffer's high-risk assessment: 2/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at event-buttcoin.com presents itself as the home of "Buttcoin," branded in its page title as "the original memecoin since 2011." It is a single-page crypto-themed promotional site that appears to market a meme token and its related event or community activity. Its apparent purpose is to attract visitors to a token-centred offering, which is a business model where visitors are commonly asked to commit funds or connect wallets.

Scam/Impersonation Risk

This site carries an elevated risk assessment, and the principal driver is the confirmed blacklisting of the domain by multiple independent threat-intelligence sources. More than one reputation engine currently classes it as malicious, and a further group flags it as suspicious. The listing is specific enough to be decisive. Edge protection and a valid certificate do not offset it. The site's central claim also conflicts with its footprint. The homepage presents the token as "the original memecoin since 2011," yet the domain was registered only a few months ago. This pattern is typical of look-alike or opportunistic campaigns that borrow the credibility of an established crypto brand. The evidence does not show conflicting legal entities or a specific impersonation target, so this is a credibility contradiction, not a proven impersonation. Browser behaviour testing was mixed. It found no wallet-connection prompts, wallet-drainer routines, clipboard manipulation, hidden forms or credential posts to outside parties. The page did make heavy use of third-party requests (27 external background requests and 9 external submissions across the test runs, nearly all of its network activity), and it logged repeated console errors. The external traffic stayed within known, whitelisted destinations. These behavioural points do not clear the site, because the page's content could change without notice. Evidence:

• Homepage: the title and branding assert an origin "since 2011," which the domain's registration in August 2026 (about 0.18 years, roughly 67 days old) contradicts.
• Threat-intelligence reputation: 2 engines rate the domain malicious and 2 more rate it suspicious; one of the flagging vendors is in the top tier of detection sources.
• Browser behaviour test, homepage: 27 external background requests, 9 external submissions, 9 console errors, and external traffic at roughly 97.6% of the peak observed load, with no wallet-drainer or clipboard-hijack activity detected.

Regulatory Verification Notes

The captured homepage was not analysed in enough depth to establish whether it names an operating company, a legal entity or any licence or registration. The site's real-world operator therefore cannot be tied to an identifiable organisation from this evidence. Ownership details in the registration record are incomplete, which is consistent with the ownership opacity that normally accompanies a very young domain. This is an administrative limitation and not an identity contradiction, because no conflicting legal entities were found. No third-party broker or regulator record matched this domain, so no external licensing signal exists either way. A token-centred promotional site would ordinarily be expected to disclose its issuer and any applicable authorisation, and the absence of such disclosure here is a verification gap and not evidence of wrongdoing in itself. Evidence:

• Homepage: no identifiable operating entity, licence or registration reference was established from the captured content.
• Domain registration: created 2026-08-19 via NICENIC INTERNATIONAL GROUP CO., LIMITED, expiring 2027-08-19, with owner details incomplete.
• Hosting: served from AS13335 (CLOUDFLARENET - Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 at domain-validated (DV) level, valid to 2027-01-15 (81 days remaining at analysis). This confirms an encrypted connection but does not confirm the operator's identity.

What to Verify Next

Anyone who encounters this domain should first compare it with the channels the genuine Buttcoin project publishes independently, using sources obtained outside this site. The aim is to confirm whether this domain is a recognised official property or an unaffiliated third party. If the domain was reached through a social-media post, message or advertisement, the sender should be authenticated through a separate route before any engagement. If the site claims any regulated activity, the named operator and authorisation should be checked directly with the relevant registry. The domain's blacklist status should also be re-checked later, since a clean result there would be the main signal that could change this posture. Evidence:

• Homepage: the "since 2011" lineage claim can be tested against the project's independently published history.
• Domain registration: the August 2026 creation date can be compared with the date the official project first referenced this address.
• Threat-intelligence listings: current blacklist status is the most direct indicator of whether the posture has changed.

Summary Verdict

The site's overall posture is high-risk. Active, confirmed threat-intelligence listings dominate the assessment, and a very recent domain makes a historic-brand claim hard to credit. Operator identity remains unverified, and no mitigating signal is strong enough to outweigh these concerns.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are edge servers. The origin server was not observable, so hosting cannot be verified independently. That also means the content behind the edge could be swapped quickly without a visible hosting change. Bot-protection screening was active during testing, and the site is served over a valid encrypted connection. These are mitigating factors only. They are common to legitimate and illegitimate sites alike, and they do not offset the reputational risk.

Closing Assessment

The site should be treated as unsafe for any interaction beyond passive viewing. Visitors should not log in, enter credentials, connect a wallet, or send or commit funds through it, and they should not download anything from it. Any outreach that points to this address should be treated as suspect until the project's official channels confirm the link independently.