ethena-airdrop[.]vercel[.]app

This domain, ethena-airdrop.vercel.app, is flagged as a high-risk brand impersonation threat targeting users through an airdrop scam. Analysis indicates the domain mimics legitimate cryptocurrency airdrop campaigns, likely designed to deceive victims into disclosing wallet credentials or transferring assets under false pretenses. No specific drainer kit was identified in the available data, but the domain aligns with known tactics used in fraudulent airdrop schemes, including the use of hosting services to lend credibility.

Technical indicators confirm the domain's malicious nature. It resolves to IP address 76.76.21.142, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). The domain was registered through Tucows Domains Inc. on February 21, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or establish persistence. VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious, while it appears on three security blocklists. The SSL certificate is issued by Google Trust Services (WR1), a common practice among threat actors to mimic legitimate encryption standards. Google Safe Browsing status was not explicitly provided, but the domain's inclusion in multiple blocklists suggests prior malicious activity.

As of the latest assessment, ethena-airdrop.vercel.app is offline, reducing immediate risk to end users. However, the domain remains registered and could be reactivated or repurposed for future campaigns. Infrastructure analysis reveals the use of a widely abused hosting provider, which may facilitate rapid redeployment. Organizations and individuals are advised to block the domain and associated IP at the network level, monitor for related subdomains or typosquatting variants, and educate users on recognizing airdrop scam tactics. Given the domain's future-dated registration, continued vigilance is warranted to detect potential resurgence or evolution of this threat.