evm-getdrop[.]netlify[.]app

Analysis of evm-getdrop.netlify.app confirms its classification as an active crypto drainer phishing site. The domain, hosted on Netlify infrastructure, resolves to 63.176.8.218, an IP address geolocated in Germany within AWS EC2's eu-central-1 region. The site presents a page titled 'GetDrop,' consistent with known crypto drainer distribution patterns. No nameservers are currently configured for the domain, which was registered on April 26, 2026. The domain is flagged by two security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and ScamSniffer. A valid SSL certificate issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1) is present, which may lend a false sense of legitimacy to potential victims. The site remains operational as of July 12, 2026, returning an HTTP 200 status code, indicating active hosting. Infrastructure analysis reveals the domain lacks traditional DNS nameservers, a tactic occasionally observed in short-lived phishing campaigns to evade detection or takedown efforts. The Gridinsoft trust score of 0/100 further supports the malicious classification. While the exact content and targeting mechanisms of the site are not yet fully analyzed, the available evidence—including its presence on multiple blocklists and its association with crypto drainer activity—justifies immediate defensive action. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for related indicators of compromise, such as wallet addresses or transaction patterns linked to this infrastructure. The domain's continued activity suggests it remains a viable threat to users interacting with cryptocurrency platforms.