dropsteams[.]top

Analysis indicates that dropsteams.top was registered on 2026-02-21 through NiceNIC International Group Co., Limited and currently resolves to the Cloudflare‑hosted address 188.114.97.3 (AS13335, United States). The domain is presently taken offline, but historical evidence shows it was used to host a page titled “Webee 3 – Secure, Scalable, Decentralized Blockchain Infrastructure”, a title unrelated to the advertised activity and lacking any TLS certificate. The site was classified as a “Fake Airdrop” campaign that impersonates the Slack brand, suggesting an attempt to lure Slack users with a cryptocurrency giveaway. Reputation metrics are extremely low: Gridinsoft assigns a trust score of 0 / 100, and twelve of ninety‑three VirusTotal scanners flagged the domain as malicious.

The domain appears on three external blocklists and has been listed by PhishDestroy, MetaMask, and SEAL as a blocked indicator. An AlienVault OTX pulse references the domain in a single threat‑intel feed. No SSL/TLS was observed, confirming the absence of encrypted transport.

While the precise phishing landing page content has not been captured, the combination of brand impersonation, fake‑airdrop narrative, and low trust scores strongly points to a credential‑stealing or crypto‑theft operation. Defenders should immediately deny DNS resolution for dropsteams.top, add the domain to local and network‑level blocklists, and monitor for any newly registered domains that resolve to the same Cloudflare IP range and exhibit similar naming patterns. Ongoing threat‑intel correlation with Slack‑related phishing campaigns is recommended to detect potential reuse of the infrastructure.