papycho[.]fr

The domain www.papycho.fr has been identified as a high‑risk generic phishing site delivering a fake airdrop campaign. Analysis classifies the site as a counterfeit reward portal designed to harvest credentials, and the risk level has been marked high by multiple intelligence sources.

Infrastructure observations show the domain was registered on March 12, 2026 through Hosting Concepts B.V. d/b/a Openprovider. Authoritative name servers are ns1.vercel-dns.com and ns2.vercel-dns.com, indicating the site is hosted on the Vercel platform. The domain resolves to IP address 216.198.79.1, which is geolocated to the United States and associated with the Lefkoff Industries network. An SSL certificate issued by Let’s Encrypt (R12) is present, and HTTP responses return a 520 status code, suggesting an unusual server configuration. The presence of HTTP Strict Transport Security (HSTS) further confirms modern web security settings despite the underlying malicious intent.

Detection data reveal the domain appears on a single security blocklist and has been flagged by PhishDestroy. The Gridinsoft trust score is 0 / 100, underscoring the malicious nature of the host. VirusTotal analysis reports four out of ninety‑five security vendors marking the domain as malicious, providing independent corroboration of the threat. The site’s page title, "[Quête] Reflet Metarifique | Le Bazar de Papycha," is unrelated to the lure and appears to be a decoy to attract French‑speaking targets.

Defenders should immediately block resolution of www.papycho.fr at network perimeter devices and incorporate the associated IP address 216.198.79.1 into intrusion‑prevention signatures. Continuous monitoring of DNS queries for the domain and its name servers is advised, as the underlying Vercel hosting could be leveraged for rapid redeployment. End‑user awareness campaigns should highlight the fake airdrop narrative and caution users against providing personal or wallet information on unsolicited sites.