matdrop[.]xyz

On 25 July 2026 analysts observed that the domain matdrop.xyz is currently offline but exhibits characteristics of a wallet/seed phishing infrastructure targeting the brand “across”. The domain was registered on 21 November 2025 through Web Commerce Communications Limited and is delegated to Cloudflare name servers ariella.ns.cloudflare.com and curt.ns.cloudflare.com. DNS resolution points to IP address 91.92.242.155, which belongs to AS202412 (Omegatech LTD) located in the Netherlands. No TLS certificate is presented for the host, indicating that any HTTP service would be delivered without encryption.

The sole visible page title retrieved prior to takedown reads “Digital Sovereignty Foundation Claim”, which does not directly reference the impersonated brand and suggests that the landing page content has not been publicly disclosed. VirusTotal reports 11 of 95 security scanners flagging the domain as malicious, and the host is listed on two independent security blocklists. Additional detection from community‑run blocklists includes PhishDestroy and ScamSniffer, both of which have marked the domain as a phishing source. The classification as a wallet/seed phishing site aligns with the reported intent to harvest cryptocurrency seed phrases.

While the site is presently offline, the infrastructure components – Cloudflare DNS, a Netherlands‑based IP, and the registrar – remain active and could be reused for future campaigns. Defenders should continue to block the domain and associated IP at perimeter defenses, monitor for re‑registration or similar naming patterns, and incorporate the observed indicators into threat‑intel feeds. Further analysis of any resurrected content, HTTP headers, or redirects would be required to confirm the full phishing workflow.