btc-airdrop[.]top

The domain btc-airdrop.top was registered on 25 April 2026 through Dominet (HK) Limited and resolves to the Cloudflare address 104.21.48.224, a server located in Canada. The site returns HTTP 200 and presents a valid Let’s Encrypt certificate (issuer E7). Infrastructure analysis shows the domain is listed on three public blocklists and has a Gridinsoft trust score of 0/100. It is actively blocked by multiple remediation tools, including PhishDestroy, MetaMask, and SEAL. VirusTotal records 16 of 94 security vendors flagging the domain as malicious, confirming a consensus of risk. The domain is classified as a brand‑impersonation campaign targeting Bitcoin and uses a fake‑airdrop narrative to lure victims. An AlienVault OTX pulse references the domain, indicating that it has been observed in at least one threat‑intel feed. Current data does not reveal the exact page content or any payload delivered, so the specific phishing kit remains unknown. Defenders should continue to block the domain at DNS and gateway levels, monitor outbound connections to the associated IP, and update detection rules to include the known nameservers (lennon.ns.cloudflare.com, meilani.ns.cloudflare.com). Ongoing observation is recommended to capture any evolution of the campaign.