dropsxrp[.]net

Analysis of the domain dropsxrp.net indicates active phishing infrastructure targeting cryptocurrency users. Registered on February 21, 2026, through RU-CENTER, the domain is currently resolving to 104.21.48.1, an IP address assigned to Cloudflare, Inc. (AS13335) in the United States. The domain is served by Cloudflare nameservers (eva.ns.cloudflare.com, jake.ns.cloudflare.com) and employs HTTP/3, suggesting modern web infrastructure. At the time of assessment, the domain returns an HTTP 403 status with the page title 'dropsxrp.net | 523: Origin is unreachable,' which may indicate a misconfigured or intentionally restricted backend while retaining active DNS resolution. The domain is flagged by nine security vendors on VirusTotal and appears on at least one security blocklist, with PhishDestroy explicitly listing it as blocked. Google Safe Browsing classifies the domain under 'SOCIAL_ENGINEERING,' consistent with phishing or scam activity. The scam type is identified as a crypto scam, though specific tactics—such as fake exchanges, wallet drainers, or token giveaways—remain unconfirmed due to the lack of accessible page content. The SSL certificate is issued by Google Trust Services (WE1), which does not mitigate the domain’s malicious classification. Defenders should treat this domain as high-risk infrastructure. The use of Cloudflare may complicate takedown efforts, but the domain’s registration through a Russian registrar and its presence on multiple blocklists justify immediate blocking at the DNS or network level. Further investigation into associated wallet addresses or redirect chains is recommended if the domain resumes serving content. No legitimate use case is identified, and the domain’s creation date aligns with recent phishing campaigns in the cryptocurrency space.