shitcoin[.]top

The domain shitcoin.top was registered on March 07, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the Cloudflare‑owned address 104.21.84.93 (AS13335). The host is located in the United States and is protected by Cloudflare services, including Browser Insights and HTTP/3 support. The site presents a TLS certificate issued by Let’s Encrypt (E7) and uses the Cloudflare nameservers amos.ns.cloudflare.com and maya.ns.cloudflare.com. When accessed, the server returns HTTP 403 and serves a page whose title is “Just a moment…”, a typical Cloudflare interstitial. The domain has a Gridinsoft trust score of 0 out of 100 and is currently listed on three public blocklists. VirusTotal analysis shows that 2 of 95 scanned security vendors flag the domain as malicious. It is also blocked by multiple industry‑specific filters, including PhishDestroy, MetaMask, and SEAL. Threat intelligence classifies shitcoin.top as a high‑risk brand‑impersonation campaign targeting the Bitcoin brand. The page does not yet reveal a credential‑capture form, but the combination of a brand name in the URL, the use of a generic “shitcoin” term, and the presence of a Cloudflare‑protected site suggests a typical cryptocurrency phishing kit that redirects victims to a malicious wallet or transaction page. The active status and recent creation date indicate a short‑lived infrastructure designed to evade detection. Defenders should add the domain to network and endpoint blocklists, enforce DNS filtering, and monitor for any outbound connections to the resolved IP address. Because the site is behind Cloudflare, traffic analysis may be limited; deploying a sinkhole or proxy that terminates TLS can reveal the underlying payload. Continuous re‑evaluation is advised, as the operators may switch to new hosting or launch credential‑stealing pages at any time.