dropcoin[.]live

Analysis of the domain dropcoin.live indicates a generic phishing campaign targeting cryptocurrency users, first registered on February 21, 2026, through Web Commerce Communications Limited. The domain resolves to IP address 172.67.172.91, hosted on Cloudflare's network (AS13335) in the United States. As of July 24, 2026, the site is offline, though it remains listed on three security blocklists, including PhishDestroy, ScamSniffer, and CryptoFirewall. A single security vendor flagged the domain in a VirusTotal scan, though the specific detection context is not detailed in available intelligence.

No SSL certificate was observed, increasing the likelihood of unencrypted credential harvesting if the site were active. Infrastructure review shows the domain lacks additional protective measures typically associated with legitimate services, such as extended validation certificates or multi-vendor domain reputation checks. The absence of an SSL certificate is particularly notable for a site purporting to handle financial transactions, as it suggests either an oversight or an intentional effort to avoid encrypted traffic inspection. The registrar, Web Commerce Communications Limited, has been previously associated with domains involved in fraudulent activity, though no direct attribution to this specific campaign is confirmed.

Defenders should treat dropcoin.live as a confirmed phishing domain based on its presence on multiple blocklists and limited vendor detections. Network-level blocking of the IP 172.67.172.91 is recommended, along with monitoring for related domains registered through the same registrar or hosted on Cloudflare infrastructure. Given the domain's association with cryptocurrency-themed phishing, users should be alerted to verify wallet addresses and transaction requests independently, particularly if originating from unsolicited communications.