bitrootsystem[.]top

This domain, bitrootsystem.top, is identified as a confirmed brand impersonation site targeting cryptocurrency users through an airdrop scam. The page title, $BRT Airdrop, explicitly mimics legitimate token distribution events to lure victims into connecting wallets, likely deploying a drainer kit to siphon funds. Analysis indicates the campaign is designed to exploit the growing popularity of token airdrops, a common vector for cryptocurrency theft, by presenting a fraudulent interface indistinguishable from genuine promotions. Infrastructure analysis reveals the domain was registered on March 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.88.209, a Cloudflare-protected endpoint, and employs HTTP/3 alongside Cloudflare Browser Insights for performance and evasion. Detection metrics show 6 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist, and automated systems previously blocked it prior to takedown. As of the latest assessment, bitrootsystem.top has been taken offline, likely due to enforcement actions by hosting providers or security platforms. However, the elevated risk persists due to the domain's recent creation, low detection coverage, and the registrar's history of hosting malicious infrastructure. Users are advised to verify airdrop legitimacy through official project channels and monitor wallet permissions for unauthorized access. The use of Cloudflare services further complicates attribution, underscoring the need for continued vigilance against similar campaigns leveraging content delivery networks for obfuscation.