drop-live.top — Crypto Drainer Phishing Campaign Report

PhishDestroy has identified drop-live.top as an active crypto drainer domain distributing malicious browser extensions claiming to provide live trading functionality. This domain mimics legitimate cryptocurrency service dropbox.live with deceptive visual similarity through URL structure and content formatting. The threat employs social engineering tactics targeting cryptocurrency users by impersonating a legitimate trading platform interface while executing unauthorized fund transfers. Security analysis indicates the drainer kit includes malicious JavaScript payloads designed to intercept wallet connections and automate transaction approvals. The infrastructure shows coordinated evasion techniques including domain fronting and certificate spoofing through Let's Encrypt validation.

This domain was flagged with a VirusTotal detection score of 5/95 security vendors, indicating moderate but concerning prevalence. Technical indicators include registration through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 29, 2026, with resolution to IP address 188.114.96.3. Google Safe Browsing categorizes this as SOCIAL_ENGINEERING malware, while security providers MetaMask and SEAL have implemented active blocking measures. The domain appears on 2 separate security blocklists, demonstrating cross-platform recognition of the threat. These indicators suggest a recently established but actively maintained phishing infrastructure with sophisticated obfuscation techniques.

drop-live.top remains in active circulation despite multiple defensive integrations, presenting an elevated ongoing risk to cryptocurrency users. Current status shows the domain is operational with SSL certificate validation, requiring immediate user caution and organizational blocking measures. Response actions include domain takedown requests submitted to hosting providers and domain registrars, along with enhanced detection rule updates for security products. Remaining risk stems from the domain's recent creation date paired with sophisticated evasion tactics, necessitating heightened vigilance among cryptocurrency service users. Users should avoid any interaction with this domain and verify platform URLs through official cryptographic signatures before engaging with trading interfaces.