drop-hub[.]fun

The domain drop-hub.fun was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolved to the IP address 172.67.208.218, which belongs to AS13335 Cloudflare, Inc. in the United States. No TLS certificate was observed, indicating the site operated without HTTPS protection. The page title returned by the server was "SAVE | Airdrop," matching the known Airdrop Scam phishing kit and aligning with the declared crypto scam type. The site impersonates the legitimate brand dexscreener, a known target for brand‑impersonation campaigns.

Infrastructure analysis shows the domain is listed on four security blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—each of which actively blocks the host. VirusTotal scans reported that three of ninety‑five security vendors flagged the domain as malicious, reinforcing the suspicion of abuse. Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of confidence in the site's legitimacy. Current status indicates the site has been taken offline, but the historical evidence suggests it was used to lure victims into a cryptocurrency airdrop trap.

Defenders should continue to block drop-hub.fun at DNS and proxy layers, monitor for any re‑registration attempts, and correlate any outbound connections to the Cloudflare IP with known malicious activity. Analysts should also update endpoint detection rules to flag the page title "SAVE | Airdrop" and watch for similar brand‑impersonation patterns targeting dexscreener. Continuous observation of the four blocklists and periodic re‑scans on VirusTotal are recommended to capture any resurgence of the domain or related infrastructure.