giftdrop[.]info

Analysis of giftdrop.info indicates this domain is actively involved in phishing operations targeting Amazon customers. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain presents itself with the page title 'Ottieni il codice promo Amazon −30%', suggesting a fraudulent promotion for Amazon discount codes. The site currently returns an HTTP 403 status, which may indicate restricted access or protective measures to evade detection, though it remains operational. Infrastructure analysis reveals the domain resolves to IP 104.21.54.82, hosted on Cloudflare's network (AS13335) in the US, with nameservers alfred.ns.cloudflare.com and perla.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites.

Detection data shows the domain is flagged by 3 out of 93 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. Technologies detected include Facebook Pixel and HTTP/3, which may be used for tracking or evasion purposes. While the exact content and mechanics of the phishing kit are not yet analysed, the page title explicitly references Amazon, indicating the likely brand target.

Defenders should treat this domain as malicious and implement blocking at the DNS or network level. Given the use of Cloudflare, additional scrutiny of other domains sharing the same IP or nameservers may reveal related threats. Monitoring for changes in HTTP status or additional detection reports could provide further insight into the campaign's evolution. No evidence currently links this domain to specific threat actors or broader phishing kits, but the combination of brand impersonation, low detection vendor coverage, and Cloudflare hosting is consistent with active phishing infrastructure.