cloud-dropx[.]online

On 23 July 2026, a technical assessment was performed on the domain cloud-dropx.online. The domain was registered on 23 May 2025 through Hostinger Operations UAB and resolves to the IPv4 address 45.67.136.10, which belongs to autonomous system AS213535 operated by YottaSrc in the Netherlands. The site presented an SSL certificate identified as R13, indicating the presence of a publicly trusted TLS layer. The page title returned by the server at the time of capture was “Boba Network – Claim Airdrop”, and the underlying kit has been classified as an “Airdrop Scam” kit, a known vector for crypto‑related phishing campaigns. The domain is explicitly marked as impersonating the Metamask brand, aligning with the declared crypto‑scam type.

Detection telemetry shows that one of ninety‑three security vendors on VirusTotal flagged the domain as malicious. The host is listed on five independent blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura, reinforcing the consensus that the infrastructure is being used for illicit activity. Independent reputation services assigned a Gridinsoft trust score of 0 out of 100, the lowest possible rating, indicating a high confidence of malicious intent. The current operational status is “offline”, suggesting that the site has been taken down or is otherwise inaccessible. No live HTTP response or page content was available for further forensic analysis, so the exact phishing landing page structure and any credential‑harvesting mechanisms remain unknown.

However, the combination of a brand‑impersonation tag, a crypto‑airdrop lure, a low trust score, and multiple blocklist entries provides sufficient evidence for defensive actions. Defenders should immediately add cloud-dropx.online to network‑level deny lists, update URL filtering policies, and monitor DNS traffic for queries to the associated IP address and ASN.