airdrop-layeredge-foundation[.]vercel[.]app

The domain airdrop-layeredge-foundation.vercel.app was registered through Tucows Domains Inc. and created on February 21, 2026. DNS resolution points to IP address 64.29.17.195, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site served HTTP status code 451 and employed HSTS, indicating that the server attempted to enforce HTTPS. A TLS certificate issued by Google Trust Services under the WR1 designation was observed, confirming the use of a legitimate certificate authority but not validating the content. The page title returned by the host was "LayerEdge Airdrop," matching the declared scam type of a fake airdrop designed to lure cryptocurrency users.

Technical fingerprints show the site was hosted on the Vercel platform, a common choice for rapid deployment of static web content. Two independent blocklists, PhishDestroy and ScamSniffer, have listed the domain, and VirusTotal analysis recorded 2 detections out of 93 security vendors, reinforcing the malicious classification. The domain is currently offline, as indicated by the "taken offline" status, but the infrastructure remains observable and could be reactivated. Analysts should treat any URLs under this domain as hostile, block the domain at network perimeter devices, and add the associated IP address to denial lists.

Continuous monitoring of the IP block for re‑use is advised, as the Amazon hosting environment may host unrelated services. Because the site is no longer serving content, forensic collection of historical HTTP responses, certificate chains, and any cached page snapshots would aid attribution. No further indicators, such as malware payloads or credential‑harvesting forms, have been disclosed, leaving the exact phishing workflow uncertain. Defensive teams should remain vigilant for future re‑deployment of the same domain or similar naming patterns targeting crypto airdrop campaigns.