The domain cupsey.droponsol.fun was registered on July 26, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is presently active. DNS resolution points to the Cloudflare‑hosted address 104.21.91.225, with authoritative nameservers galilea.ns.cloudflare.com and moura.ns.cloudflare.com, indicating the use of a reputable CDN for traffic forwarding. The domain has been listed on a single security blocklist and was flagged by the PhishDestroy service, confirming that security operators have identified it as malicious.
VirusTotal records show that the domain was examined by 91 scanning engines; at the time of analysis no vendor reported a detection, but the absence of a flag does not constitute a safety guarantee. No public Safe Browsing, OTX, SSL certificate, HTTP response code, trust‑score, or page‑title information is presently available for this host, and no evidence links have been disclosed. The limited visible infrastructure—recent registration, Cloudflare hosting, and inclusion on a blocklist—combined with the designation as a delivery‑scam vector suggests a high likelihood of fraudulent activity aimed at deceiving recipients with false delivery notifications.
Defenders should continue to block the domain at perimeter controls, monitor DNS queries for the associated IP and nameservers, and add the domain to internal threat‑intel feeds. Ongoing observation of any emerging detections from additional scanning services or blocklist updates is recommended to refine risk assessments as further indicators become available.