0x[.]dropit[.]space

On 24 July 2026, the domain 0x.dropit.space was observed serving a page titled “DROPiT - Airdrop Tracker”. The site was hosted on Vercel infrastructure and presented an HTTP 404 response while enforcing HSTS. The TLS certificate was issued by Let’s Encrypt (R12) and the server resolved to IP 76.76.21.93, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. Registration data show the domain was created on 21 February 2026 via OVH, using the nameservers dns20.ovh.net and ns20.ovh.net.

Security analysis reveals a Gridinsoft trust score of 0 out of 100 and a detection by one blocklist (PhishDestroy). VirusTotal recorded a single positive detection out of 93 scanning engines, confirming malicious intent. The observed kit is classified as an “Airdrop Scam”, indicating the operator is attempting to lure victims with a fake cryptocurrency airdrop service.

At the time of analysis the site was taken offline, which prevents further live interaction but does not eliminate the risk of reuse of the same infrastructure or domain in future campaigns. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP range and OVH name servers for similar activity, and add the indicator to internal threat intel feeds. Additional observation of any re‑registration or resurrection of the site should trigger immediate investigation, especially given the low trust score and the presence of a known phishing kit.