meta-drop[.]xyz

The domain meta-drop.xyz was registered on February 21 2026 through GMO Internet Group, Inc. d/b/a Onamae.com and is currently using the expired Onamae nameservers dns1.onamae‑expired.com and dns2.onamae‑expired.com. HTTP requests return status 200 and the page title is identical to the domain. Technical fingerprinting reveals a Node.js stack with Express, Envoy as a reverse‑proxy, HSTS enforcement, and delivery via Akamai edge services. The infrastructure has been observed on six public blocklists, including PhishDestroy, ScamSniffer, Polkadot, CryptoFirewall, and Enkrypt. Gridinsoft assigns a trust score of 0 out of 100, indicating maximal lack of confidence. VirusTotal analysis shows that 10 of 93 scanning engines have flagged the domain as malicious. AlienVault OTX references the domain in a single threat‑intel pulse. The domain is classified as generic_phishing with a high risk rating and remains active. No additional intelligence on the payload, targeted brand, or phishing landing page has been published. Defenders should block the domain at perimeter filters, monitor DNS queries for the listed nameservers, and add the domain to internal blacklists. Continued observation is advised to detect any evolution of the payload or new host infrastructure.