finishdrop[.]com

The domain finishdrop.com was observed as offline on the report date of July 24, 2026. Registration data indicates the domain was created on April 18, 2025 through Tucows Domains Inc., and it is served by Google‑managed nameservers ns-cloud-d1.googledomains.com, ns-cloud-d2.googledomains.com and ns-cloud-d3.googledo. DNS resolution points to IP address 23.227.38.67, which belongs to AS13335 Cloudflare, Inc. and is geolocated in Canada. The site presented the page title "FinishDrop Officiel France" and employed a TLS certificate issued by Google Trust Services under the WE1 profile, confirming the use of a valid HTTPS endpoint. Infrastructure analysis reveals the presence of Shopify, jQuery, HTTP/3, HSTS and Cloudflare services, indicating a typical e‑commerce hosting stack.

The domain is listed on two security blocklists, PhishDestroy and Enkrypt, and two of ninety‑five VirusTotal scanners flagged it as malicious. Additional reputation data shows a Gridinsoft trust score of 0 out of 100. Email routing is configured with an MX record pointing to mx.finishdrop.com.cust.b.hostedemail.com. The campaign is classified as a brand impersonation targeting American Express, as indicated by the intelligence field "Impersonates: american express" and the generic scam type "Brand Impersonation".

While the site is currently taken offline, the observed infrastructure suggests that the operators leveraged a legitimate e‑commerce platform to increase credibility. Defenders should block the domain and its associated IP at network perimeters, monitor for outbound connections to the Cloudflare‑hosted address, and add the domain to internal threat‑intel feeds. Email security solutions should enforce strict sender verification for the listed MX host, and users should be reminded that any unsolicited communications referencing American Express from this domain are fraudulent. Continuous re‑evaluation is advised in case the infrastructure reappears or is repurposed for new campaigns.