Is early-drop.fun a scam? TrustSniffer's high-risk assessment: 17/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website early-drop.fun is a single-page, airdrop-themed site titled "Hoodrat | Airdrop". It presents itself as a token or reward distribution landing page, and its apparent purpose is to attract visitors to a promotional "airdrop" offering. The captured page returned text content normally, but the available analysis did not identify any named operator, product terms or corporate identity behind it.

Scam/Impersonation Risk

Contradictory signals are present, and they are the decisive factor in this assessment. The domain is blacklisted by external threat-intelligence sources. One engine rated it malicious and several others rated it suspicious, including a tier-one security vendor. Airdrop-themed pages are a common lure for credential and wallet-harvesting campaigns, and a domain registered only recently is consistent with disposable campaign infrastructure. Sandbox observation did not capture active exploitation. The page made no external network calls, showed no wallet-connection prompts, clipboard manipulation, hidden forms or cloaking, and it behaved consistently across all test runs. These observations do not offset the blacklist. A page can appear inert to automated testing and still serve a lure or be switched to harmful content later. No conflicting legal identities and no brand impersonation were observed, because the site presents no legal identity at all. No suspicious contact address was found. Evidence:

• Homepage: external blacklist hit, with one malicious and three suspicious detections across the reputation engines, including a tier-one security vendor.
• Domain registration record: created 2026-07-31, roughly 0.24 years (about 87 days) old at the time of analysis.
• Homepage behavioral testing: three of three runs succeeded with no external requests, wallet-connection activity or clipboard writes.

Regulatory Verification Notes

The site presents no legal, licensing or corporate-identity disclosures that could be assessed, and the operator's real-world identity remains unverified. Ownership and governance transparency are limited, and the registrant is not identifiable from the site or its registration profile. For a site that invites participation in a token distribution, this is a material verification gap. It is not a regulatory finding in itself, and no third-party broker or regulator record matched this domain. The site is not recognized in any DeFi protocol directory, so no independent listing supports its claims. Evidence:

• Homepage: no operator name, company registration, licensing statement or terms of participation observed.
• Domain registration: registrar is NICENIC International Group Co., Limited, with registration valid to 2027-07-31.
• Hosting and encryption: served from AS13335 (Cloudflare, US); TLS certificate issued by WE1 (DV, domain validation only), valid to 2026-12-27.
• DeFi directory check: domain not listed, so no TVL or protocol recognition exists.

What to Verify Next

Any claim that a legitimate project is behind this airdrop should be confirmed through that project's own official channels, reached independently of this site. The project's official social accounts and documentation should state whether this exact domain is authorized. A contact route obtained offline, or from a source the visitor already trusts, should confirm the operator. The blacklist status should be rechecked against current threat-intelligence listings before any change in posture is considered. Evidence:

• Homepage: airdrop branding offered without any verifiable project or issuer attribution.
• Domain registration: very recent creation, so no long-standing operating history supports its claims.
• Threat-intelligence listings: current external detections remain the controlling reference.

Summary Verdict

The overall posture is elevated risk. Confirmed external blacklisting and the domain's very recent creation outweigh the absence of observed malicious behavior in testing. Apparent technical hygiene does not establish legitimacy, and the real-world operator remains unidentified.

Infrastructure Integrity

The site sits behind a mainstream CDN/WAF, with a valid certificate from a known issuer. Only edge addresses were observable, so the origin hosting could not be assessed independently. Edge-only visibility also means page content can be swapped quickly without any visible change in hosting. This protection is a mitigating factor only and does not offset the reputational risk. Domain-validated encryption confirms control of the domain and says nothing about who operates it.

Closing Assessment

At most, the site should be viewed read-only, without connecting a wallet, entering credentials or logging in. It should also not be used for any financial interaction, or for downloads, until it is removed from threat-intelligence listings and its operator is independently confirmed.