demoeth[.]vercel[.]app

This domain, demoeth.vercel.app, is flagged as an active crypto scam targeting Ethereum users through a fraudulent ETH AirDrop scheme. Registered on February 21, 2026, via Tucows Domains Inc., the site resolves to IP 216.198.79.67, hosted on Amazon.com, Inc. infrastructure (AS16509) in the US. The page title explicitly advertises an 'ETH AirDrop,' aligning with known phishing kits classified as Airdrop Scams. SSL certification is provided by Google Trust Services, and the domain is served through Vercel with HSTS enabled, suggesting a structured deployment rather than opportunistic hosting. Analysis indicates the domain is currently active, returning an HTTP 200 status, and has been blocked by at least one security vendor. Gridinsoft assigns a trust score of 0/100, while Scamadviser rates it 21/100, both reflecting high-risk classifications. The domain appears on one security blocklist, though no detections were recorded in the most recent scans by 93 vendors—absence of detections does not confirm legitimacy. Defenders should treat this domain as a confirmed impersonation threat. The infrastructure, including Vercel hosting and Amazon IP allocation, is consistent with scalable phishing operations. Given the explicit branding of an ETH AirDrop and the domain’s recent creation, the site is likely designed to harvest credentials or private keys under false pretenses. Immediate blocking at DNS or proxy level is recommended, alongside monitoring for related subdomains or IP reuse. Further investigation should focus on identifying wallet addresses or redirect chains linked to this campaign.