xpl-drop[.]xyz

Analysis of the domain xpl-drop.xyz indicates that it has been actively used for a generic phishing campaign. The site was registered on 28 October 2025 through NiceNIC International Group Co., Limited and is currently hosted behind Cloudflare’s network (ASN 13335). DNS resolution points to the IP address 172.67.183.101, which is attributed to the United States and belongs to Cloudflare, Inc. No TLS certificate is presented, confirming the absence of HTTPS protection. The domain resolves to two Cloudflare nameservers, brenna.ns.cloudflare.com and rajeev.ns.cloudflare.com, which is consistent with the hosting provider’s default configuration. Reputation services have flagged the domain.

VirusTotal reports that nine out of ninety‑five scanned security vendors have identified malicious activity associated with xpl-drop.xyz. The Gridinsoft trust score is 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has also listed the domain as blocked. The page title returned from the live endpoint, “Pieni hetki…”, offers no additional context about the targeted brand or payload. The site’s current status is offline, which limits further on‑site inspection.

Consequently, the exact phishing vector, credential‑stealing page structure, or target audience remain unverified. However, the convergence of multiple independent detections, a zero trust score, and a lack of SSL suggests a high likelihood of fraudulent intent. Defenders should add the domain and its associated IP address to their deny‑list configurations, monitor for any future DNS changes, and block requests to the identified Cloudflare nameservers when they resolve to xpl-drop.xyz. Continuous observation of VirusTotal and other reputation feeds is recommended to capture any resurgence of the domain or related infrastructure.