trumpdrop[.]app

Analysis of trumpdrop.app shows a high‑risk brand‑impersonation campaign targeting Solana users. The site resolves to IP 172.67.182.7, owned by AS13335 Cloudflare, Inc., and is hosted behind Cloudflare’s network with nameservers becky.ns.cloudflare.com and kevin.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS connection. HTTP requests return status 200 and the service supports HTTP/3, Unpkg, and Cloudflare Browser Insights, all typical of a standard Cloudflare‑protected site. The page title "$TRUMP – Solana Airdrop Claim" and the classification of the kit as an "Airdrop Scam" confirm the intent to lure victims with a fake Solana airdrop. VirusTotal reports three of ninety‑three scanners flagging the domain, and the domain appears on one external blocklist. It was registered on 21 February 2026 through Cloudflare and is currently listed as blocked by PhishDestroy, while Gridinsoft assigns a trust score of 0/100. The evidence collectively indicates an active crypto‑scam operation that impersonates Solana branding. Uncertainty remains regarding the exact content delivered to visitors, as no visual analysis is available. Defenders should block the domain at network perimeter, monitor DNS queries for the associated IP and nameservers, and add the domain to internal threat intel feeds. Users should be warned that any unsolicited Solana airdrop claim from this URL is malicious and should be ignored.