sodrop[.]top

Analysis indicates that the domain sodrop.top was registered on November 3, 2025, through NiceNIC International Group Co., Limited and is currently offline. The domain resolved to the IP address 172.67.179.170, hosted on Cloudflare's infrastructure (AS13335) in the United States. Nameservers coen.ns.cloudflare.com and tia.ns.cloudflare.com were in use, and no SSL certificate was detected. The page title 'Un momento…' suggests an attempt to mimic a temporary verification or loading page, though the exact content and target remain unconfirmed due to the domain's offline status.

Security vendors have flagged sodrop.top with varying levels of detection: Gridinsoft assigned a trust score of 0/100, and the domain appears on one security blocklist. PhishDestroy has blocked access to this domain. Three out of 95 security vendors on VirusTotal identified it as malicious, though the specific nature of the threat—whether credential harvesting, malware distribution, or another phishing variant—remains unclear without further forensic data. Defenders should treat this domain as a confirmed phishing threat based on its detection history and infrastructure.

The use of Cloudflare nameservers and hosting is consistent with phishing campaigns seeking to obscure origin and evade takedowns. Given the domain's registration age and current offline status, it may have been part of a short-lived campaign or could resurface under a different configuration. Network-level blocking of the IP 172.67.179.170 and monitoring for related domains registered via NiceNIC are recommended. No brand or scam type was explicitly identified in the available data, so defenders should not assume a specific impersonation target without additional evidence.