gadrop[.]sbs

This domain, gadrop.sbs, is flagged as an active generic phishing infrastructure as of July 19, 2026. Analysis indicates it is currently resolving to the IP address 203.161.45.11, hosted under Web-hosting.com in the Netherlands. The domain is registered through Global Domain Group LLC and uses nameservers launch1.spaceship.net and launch2.spaceship.net. A 403 Forbidden HTTP status is returned, suggesting the server is configured to block direct access, which is a common tactic to evade automated scanning or casual inspection while maintaining operational readiness. Infrastructure review shows the domain appears on at least one security blocklist (PhishDestroy) and is flagged by 4 of 91 security vendors on VirusTotal, indicating detection by multiple engines. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for both legitimate and malicious sites due to its accessibility and short validity periods. The exact phishing target or campaign type remains unconfirmed, as the page title (403 Forbidden) provides no brand-specific indicators or content details. Defenders should treat this domain as high-risk infrastructure. The 403 response does not confirm inactivity—phishing sites often restrict access to specific user agents, referrers, or geolocations. Blocking the domain at DNS or proxy level is recommended, along with monitoring for related subdomains or newly registered domains under the same nameservers or registrar. If this domain is observed in logs, investigate for credential theft, malware distribution, or follow-on lateral movement, particularly if user interaction with the site occurred prior to the 403 response.