airdropofc[.]vercel[.]app

The domain airdropofc.vercel.app was registered through Vercel Inc. and resolves to the IP address 64.29.17.195, which is hosted in the United States under ASN 16509 owned by Amazon.com, Inc. The site presented a page title of "OneFootball Club Pre‑TGE Portal" and was classified as a "Fake Airdrop" crypto‑drainer campaign. Network‑level analysis shows the server presents a Google Trust Services / WR1 SSL certificate and enforces HTTP Strict Transport Security, consistent with the Vercel hosting stack. An HTTP request returned a 404 status, indicating the content is no longer accessible; the current operational status is listed as offline.

Reputation services provide mixed signals: the domain appears on a single security blocklist and is blocked by PhishDestroy, while Scamadviser assigns a trust score of 41 out of 100. VirusTotal recorded a single detection out of 95 scanned engines, suggesting at least one security vendor flagged the site as malicious. The limited detection footprint and the presence of only one blocklist entry imply that the campaign may have been short‑lived or low‑volume.

Defenders should continue to monitor DNS queries for the IP 64.29.17.195 and the domain name, enforce outbound filtering for known crypto‑drainer patterns, and consider adding the domain to internal blocklists. Since the site is already offline, remediation focus should shift to preventing similar Vercel‑hosted impostor sites that reuse legitimate‑sounding titles and SSL certificates to gain user trust.