dropnow[.]fun

Analysis as of July 24 2026 indicates that dropnow.fun is associated with a generic phishing operation. The domain was registered on February 27 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare’s network (AS13335) with the IP address 172.67.171.48 located in the United States. DNS resolution points to Cloudflare name servers kay.ns.cloudflare.com and trey.ns.cloudflare.com, and the site does not present an SSL/TLS certificate, serving only an HTTP response that returns the default nginx page title “Welcome to nginx!”. The lack of encryption, combined with the generic landing page, is consistent with infrastructure used for phishing campaigns that rely on temporary hosting.

Threat intelligence feeds have listed the domain on three security blocklists, and three of ninety‑three VirusTotal scanners have flagged it as malicious. Additional blocking has been applied by PhishDestroy, MetaMask, and SEAL, reinforcing the assessment of malicious intent. The current operational status is offline, which may indicate takedown or temporary suspension. However, the historical footprint remains relevant for correlation with other incidents.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration or reuse of the same IP range, and consider adding the associated IP and name‑server pair to internal deny lists. Because the site lacks TLS, any future activation would be trivially detectable by TLS inspection. Continued observation of Cloudflare‑hosted assets linked to the same IP is advised to pre‑empt re‑use in new phishing campaigns.