dirnodrop[.]com

This domain, dirnodrop.com, is flagged as a credential harvesting phishing site targeting file storage and cloud service users. The domain is currently offline, though prior activity suggests it was designed to impersonate legitimate file-sharing or document storage platforms to collect login credentials. Analysis indicates dirnodrop.com was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026. It resolves to the IP address 188.114.96.3 and has been detected by 5 of 95 security vendors on VirusTotal. The domain appears on one security blocklist and was included in one AlienVault OTX threat intelligence pulse. Infrastructure analysis reveals the domain was taken offline following detection, though residual risk remains due to its recent creation and prior malicious classification. Current status shows dirnodrop.com is inactive, but organizations should remain vigilant for similar domains using the same infrastructure or registration patterns. Network defenders are advised to block the domain and its associated IP (188.114.96.3) at the perimeter. Security teams should monitor for credential reuse attempts from users who may have interacted with the site prior to takedown. Endpoint protection rules should be updated to detect and prevent access to newly registered domains with similar naming conventions or hosting patterns.