duky[.]free-drop[.]fun

Analysis of duky.free-drop.fun indicates that the domain was registered on July 28, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on Cloudflare name servers brynne.ns.cloudflare.com and rudy.ns.cloudflare.com. The domain resolves to the IP address 188.114.96.3 and remains active as of the report date, July 30, 2026. It appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming its association with phishing activity.

VirusTotal records show that the domain was scanned by 91 antivirus and URL‑reputation vendors, none of which reported a detection at the time of scanning; this absence of detections does not constitute a safety assurance. No public Safe Browsing, OTX, SSL certificate, HTTP status code, trust‑score, page‑title, or evidence‑link information is available in the current intelligence set. The limited visibility suggests that the threat actor may be leveraging a newly‑created domain to avoid legacy reputation systems while relying on Cloudflare’s infrastructure to obscure origin.

Defenders should add duky.free-drop.fun to deny lists across perimeter and endpoint controls, monitor DNS queries for the IP 188.114.96.3, and enforce strict URL filtering for any traffic to the domain. Continuous re‑scanning with multiple vendors is recommended to detect any future payloads or malicious redirects. Given the active status and blocklist presence, the domain should be treated as a high‑confidence phishing indicator pending further investigation.