drop[.]uscrsol[.]network

The domain drop.uscrsol.network is currently flagged as a high‑risk generic phishing site. It appears on a security blocklist and has been identified by PhishDestroy. VirusTotal records show that 1 of 95 scanned security vendors flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. The HTTP response returns a 403 status code, and the page title presented by the server is “Just a moment…”.

Infrastructure analysis shows the domain resolves to the IP address 172.67.179.173, which belongs to AS13335 operated by Cloudflare, Inc. The IP is geolocated to the United States. The TLS certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS endpoint. Traffic is served through Cloudflare’s edge network, with Cloudflare Browser Insights and HTTP/3 enabled.

The listed intelligence classifies the activity as a crypto scam, though the exact payload or credential‑harvesting mechanism has not been observed. The page content beyond the title has not been publicly disclosed, leaving the specific phishing lure uncertain. The domain remains active, and its presence on the blocklist suggests ongoing malicious use.

Defenders should block resolve‑to IP 172.67.179.173 and the domain drop.uscrsol.network at the perimeter, update intrusion detection signatures to alert on HTTP 403 responses from this host, and monitor for any outbound connections to the same IP range. Continuous re‑evaluation of VirusTotal and other reputation feeds is advised to capture any changes in vendor detections.