dropcoins[.]live

Analysis on July 24, 2026 identifies dropcoins.live as an active fake‑airdrop phishing site. The domain was registered on March 04 2026 through Global Domain Group LLC and resolves to the Cloudflare‑owned address 172.67.172.162, ASN 13335, located in the United States. The TLS certificate is issued by Let’s Encrypt (profile E7) and the site serves HTTP 200 responses over HTTP/3, indicating a fully functional web server. The page title reported by scanners is “Annika’s Pencil | AirDrop”, which aligns with the listed scam type “Fake Airdrop”. Technical fingerprinting shows a Node.js stack employing Vue.js, Nuxt.js, and Cloudflare Browser Insights, all common in modern phishing kits.

The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal records a single positive detection out of 94 scanning engines, confirming at least one vendor flags the site as malicious. The infrastructure uses Cloudflare nameservers nick.ns.cloudflare.com and dolly.ns.cloudflare.com, providing typical DNS obscurity. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment.

The phishing kit is identified as an “Airdrop Scam”, matching the observed lure of a cryptocurrency airdrop. No additional content analysis is available beyond the page title, so the exact user‑facing impersonation cannot be confirmed. Defenders should treat dropcoins.live as high‑risk: block the domain at perimeter firewalls, add its IP address 172.67.172.162 to deny‑list rules, and monitor for any future changes in detection counts or additional blocklist listings. Continuous re‑scanning is recommended to capture possible updates to the site’s payload or hosting configuration.