Is apedrop-distro.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Google, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a recently registered domain whose name suggests a token-distribution or "drop" service. Its front page was not available to an automated visitor. Instead of site content, the page returned a security interstitial titled as a suspected-phishing warning, with only a small amount of text behind it. The analysis therefore found no published products, terms, or company description. The apparent purpose is unconfirmed, but the naming pattern and the warning page are typical of campaigns that lure visitors into claiming or "distributing" crypto assets.

Scam/Impersonation Risk

Contradictory signals are present, and they are serious. Browser safe-browsing protection classifies the domain as a social-engineering threat, and a substantial number of independent security engines, including several top-tier vendors, mark it as malicious or suspicious. Together these amount to a confirmed blacklist condition. The front page now serves a phishing-warning interstitial in place of ordinary content. No brand impersonation and no conflicting legal identities were observed, but the site's own text was too limited to test for either. The sandbox did not detect wallet-drainer behaviour, clipboard manipulation, hidden forms, or externally submitted password forms across three runs. That absence does not offset the external detections. The sessions did show a very high share of outbound traffic to third-party hosts, many page errors, and large post-interaction DOM changes. These are consistent with a heavily scripted page and add to the cautionary picture. The domain's age and its single archive capture mean there is no track record of benign operation. Evidence:

• Homepage: capture returned an HTTP 403 bot-challenge page titled as a suspected-phishing warning, with about 400 characters of text.
• Threat intelligence: safe-browsing match for social engineering, plus 10 malicious and 3 suspicious detections from security engines.
• Domain provenance: registered 2026-07-28 (~0.25 years old).
• Web archive: 1 snapshot, in 2026 (1 year tracked), so there is no earlier history.

Regulatory Verification Notes

No legal, licensing, or identity pages could be assessed, and no regulatory standing could be linked to the operator. No broker-reputation match exists, so there is no third-party regulatory context either way. The real-world operator is unidentified, and registrant details are incomplete, which is a case of ownership opacity. That is an administrative limitation and not an identity contradiction. It does not itself prove wrongdoing, but with a service that appears to solicit token or wallet interactions, the lack of any disclosed entity, licence, or registration is a material gap. A valid certificate does not change this, because domain-validated certificates are issued to any domain holder without checking who operates it. Evidence:

• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport security: TLS certificate issued by WE1, domain-validated (DV), valid to 2026-12-24.
• Registrar: NICENIC International Group Co., Limited; registration runs to 2027-07-28.

What to Verify Next

No verification step can make this domain safe to use while the threat detections stand. The useful checks concern where the site came from and whether it is being used to impersonate something. Any referral link, message, or advertisement that led to this domain should be traced to its source. The claimed project or brand should be checked through its officially published channels, reached independently of this domain. Any wallet approvals or credentials already given to this site should be reviewed. Reported abuse should be tracked and the domain re-checked later, since a false positive or a cleaned compromise would show up as delisting by the flagging parties. Evidence:

• Homepage: the warning interstitial gives no site-specific claim that could be checked, so the referral source is the only available lead.
• Reputation: the flags come from several independent sources, so a single delisting would not clear the domain.

Summary Verdict

The overall posture is high risk, driven decisively by confirmed external threat detections. The domain's short life and the absence of an identifiable operator strengthen that assessment. The sandbox did not observe active exploitation, and the site's behaviour offers no basis for treating the detections as a false positive.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and web application firewall. All observed addresses are edge servers, and the origin server is not visible. This is a mitigating factor only. It shows a mainstream, well-managed delivery layer, and the reputation of the shared edge addresses is clean. It does not reduce the domain-level threat listings, and it prevents independent verification of where the content is actually hosted.

Closing Assessment

The site should be treated as unsafe for any login, credential entry, wallet connection, or financial interaction, and downloads from it should be avoided. If a user has already interacted with it, they should revoke wallet permissions, change reused passwords, and report the link to the platform where it was found.