pondox-drops[.]xyz

Analysis as of July 24, 2026 indicates that the domain pondox-drops.xyz is no longer reachable and has been taken offline. The site was registered on February 21, 2026 and immediately began serving a page titled “$RICH Distribution”, a naming convention commonly observed in cryptocurrency‑related fraud campaigns. The page title and the explicit reference to a “Crypto Scam” in the intelligence point to an impersonation of Coinbase, which is further corroborated by the “Impersonates: coinbase” tag. The domain resolves to the IPv6 address 2a02:4780:1:466:0:1d46:3405:d, which maps to an infrastructure owned by Hostinger International Limited (AS47583) and is geolocated in the United States. The TLS certificate presented is identified only as “WR1”, providing no transparent certificate authority information and suggesting a low‑cost or self‑signed issuance typical of malicious operators.

Reputation services have flagged the domain: it appears on a single security blocklist and has been actively blocked by the PhishDestroy service. On VirusTotal, two out of ninety‑three scanners raised detections, reinforcing the malicious classification despite the modest detection count. Gridinsoft assigned a trust score of zero out of one hundred, indicating an extremely low confidence in the domain’s legitimacy. The combination of a newly created domain, a generic page title tied to crypto enrichment, an IPv6 host on a shared hosting provider, a non‑descriptive SSL certificate, and multiple independent detections constitutes a high confidence indicator of a credential‑harvesting or fraud operation targeting Coinbase users.

Defenders should immediately add pondox-drops.xyz to DNS and web‑filter block lists, enforce outbound filtering for connections to the associated IPv6 address, and monitor for any similar domains that reuse the “$RICH Distribution” title pattern or that resolve to the same Hostinger ASN.