cash-drop[.]netlify[.]app

Analysis as of July 24, 2026 shows that the domain cash-drop.netlify.app resolves to the Amazon-owned address 35.157.26.135, an IP registered to AS16509 in Germany. The site is hosted on Netlify, which is reflected in the technology fingerprint that identified Netlify and the presence of HTTP Strict Transport Security (HSTS). DNS resolution uses the nsone.net name servers (dns1.p01.nsone.net through dns4.p01.nsone.net), and the domain was originally registered on May 09, 2018 through Netlify’s registrar service. An SSL certificate issued by DigiCert Global G2 TLS RSA SHA256 (2020 CA1) is active, providing HTTPS encryption despite the site currently returning a 404 HTTP status and being listed as offline.

The page title returned from the endpoint is "CashDrop," and the domain appears on a single security blocklist, specifically PhishDestroy, indicating that at least one security vendor has flagged it as malicious. VirusTotal has recorded scans from 93 vendors with no detections, but the absence of alerts does not constitute proof of safety, especially given the phishing classification. Concrete evidence of the phishing content is limited to the page title and blocklist entry; the actual payload, credential‑harvesting forms, or targeted brand are not observable because the site is offline.

Consequently, the confidence in the phishing nature rests on the blocklist designation and the generic phishing type supplied in the intelligence. Defenders should continue to block the domain at perimeter firewalls, add the IP address to threat‑intelligence feeds, and monitor Netlify‑hosted assets for similar patterns. Ongoing surveillance of the DNS records and any future HTTP responses is recommended to detect possible re‑activation or changes in hosting that could resume malicious activity.