drops-access[.]top

The domain drops-access.top was observed by multiple threat‑intelligence feeds and is currently offline. Registration data indicates it was created on 11 December 2025 through the registrar 耐思尼克国际集团有限公司. The authoritative nameservers aragorn.ns.cloudflare.com and stella.ns.cloudflare.com place the domain under Cloudflare’s DNS service, and the resolved address 172.67.218.166 belongs to AS13335 Cloudflare, Inc., located in the United States. No TLS certificate is presented, and HTTP requests return a Cloudflare 522 “Connection timed out” page, suggesting the origin server is no longer responding.

The site is associated with an “Airdrop Scam” phishing kit, a known template used to lure victims into providing cryptocurrency wallet credentials under the pretext of a free token distribution. Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme malicious confidence. VirusTotal scans recorded eight detections out of ninety‑three antivirus engines, confirming that at least a subset of security products recognize the domain as malicious. The domain appears on five external blocklists and is actively blocked by PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura.

AlienVault OTX lists the domain in a single threat‑intel pulse, further corroborating its malicious reputation. While the offline status prevents direct observation of the payload or landing page, the combination of recent creation, Cloudflare hosting, lack of encryption, and alignment with a documented airdrop‑phishing kit provides sufficient evidence to classify the domain as a high‑confidence phishing infrastructure. Defenders should add drops-access.top to URL filtering, domain‑blocking, and sink‑hole rules, monitor for any re‑use of the associated IP range, and ensure that endpoint protection solutions are updated to flag the eight VirusTotal detections.