fredrop-netlify[.]world

This domain is flagged as a high-risk generic phishing threat, currently active and hosted behind Cloudflare infrastructure. The domain fredrop-netlify.world was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, and its nameservers (nero.ns.cloudflare.com and tessa.ns.cloudflare.com) indicate Cloudflare DNS management. The domain resolves to IP 104.21.64.1, which belongs to Cloudflare, Inc. (AS13335) in the United States, and its SSL certificate is issued by Google Trust Services (WE1). HTTP requests return a 403 status with the page title 'Just a moment...', suggesting the domain uses a Cloudflare challenge or access restriction, possibly to evade automated analysis. MX records point to _dc-mx.c7f0210f98c7.fredrop-netlify.world, indicating email handling infrastructure, which could be leveraged for phishing campaigns. Threat intelligence shows the domain appears on one security blocklist (PhishDestroy) and is flagged by 3 of 93 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100, reinforcing the high-risk assessment. The exact impersonated brand or site type is not identified from the available data; the domain structure suggests an attempt to mimic a legitimate Netlify-related service or general web hosting. Defenders should block all traffic to this domain and its IP range, monitor for related subdomains or variations, and investigate email activity associated with the MX records. Given the active status and cloud-based hosting, the domain may change IPs or pivot to new infrastructure; continued monitoring is recommended.