drops-usd[.]xyz

Analysis of the domain drops-usd.xyz indicates it was actively used for phishing targeting cryptocurrency wallet credentials. The domain was registered on February 21, 2026, and has since been taken offline. As of July 24, 2026, it is flagged by six security blocklists, including PhishDestroy, ScamSniffer, Polkadot, CryptoFirewall, and Enkrypt. VirusTotal reports that 8 of 93 security vendors classify this domain as malicious, reinforcing its association with phishing infrastructure.

The domain's rapid inclusion on multiple blocklists suggests it was part of a broader campaign to deceive users into disclosing sensitive wallet information. No specific brand impersonation or phishing kit details are confirmed in the available intelligence, though the domain name and detection context imply a focus on cryptocurrency-related fraud. The exact content of the phishing page remains unanalyzed, as the site is currently offline.

Defenders should treat this domain as high-risk for credential harvesting, particularly in crypto-related contexts. Network-level blocking is recommended for any residual resolution attempts, and security teams should monitor for related domains using similar naming conventions (e.g., 'drops', 'usd') that may emerge as part of the same campaign. The domain's brief operational window and subsequent takedown suggest it was part of a short-lived but targeted effort to exploit users.