trumpx[.]dpdns[.]org

Analysis of trumpx.dpdns.org indicates an active high‑risk generic phishing operation that leverages a fake airdrop lure. The site was registered on March 25 2026 through Gandi SAS and resolves to the Cloudflare‑managed address 172.67.163.159, located in Canada. DNS resolution uses four nameservers (ns1‑ns4.digitalplat.org). The TLS certificate is issued by Google Trust Services under the WE1 root, confirming HTTPS availability. An HTTP 301 redirect is observed, and the page title returned is “TRUMPX Airdrop Claim,” matching the known “Airdrop Scam” phishing kit. Infrastructure fingerprints include jsDelivr, Cloudflare Browser Insights, Cloudflare, and HTTP/3 support. VirusTotal reports a single vendor detection out of 94, and the domain appears on one external blocklist (PhishDestroy). Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. Current intelligence does not reveal the exact payload or credential‑capture mechanism, and no visual content has been examined. Defenders should add the domain to URL filtering and DNS sinkhole rules, monitor outbound connections to the associated Cloudflare IP range, and ensure that email gateways block messages referencing “TRUMPX” airdrop claims. Continuous re‑scanning is advised to capture any changes in detection status or additional malicious infrastructure.