dixodrop[.]com

This domain, dixodrop.com, is flagged as a generic phishing site targeting digital collectors through a fabricated Russian-language community portal. Analysis of the page title, "Сообщество коллекционеров — для настоящих энтузиастов цифровых коллекций!", indicates a lure aimed at cryptocurrency and NFT enthusiasts, likely designed to harvest login credentials, wallet keys, or deploy malicious smart contracts. No direct association with known legitimate brands or drainer kits has been confirmed, though the social engineering tactics align with common crypto-phishing campaigns observed in Q2 2024. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.96.3 and was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. VirusTotal detection ratio stands at 6/95 security vendors, while AlienVault OTX records the domain in 8 threat intelligence pulses. The domain appears on a single security blocklist and holds a Gridinsoft trust score of 0/100. Google Safe Browsing status is not explicitly listed, but the domain is blocked by PhishDestroy, corroborating its malicious classification. As of the latest verification, dixodrop.com has been taken offline, reducing immediate exposure. However, residual risk persists due to the domain’s registration remaining active until 2026, allowing threat actors to reactivate infrastructure. Organizations and individuals are advised to block the domain and associated IP at perimeter defenses, monitor for credential reuse from exposed users, and conduct retrospective log analysis for connections to 188.114.96.3. Users who interacted with the site should rotate credentials, revoke wallet approvals, and scan devices for secondary payloads. Proactive threat hunting for related domains registered via NICENIC INTERNATIONAL GROUP CO., LIMITED is recommended to identify potential campaign expansion.