dropinfo[.]vercel[.]app

The domain dropinfo.vercel.app was observed on July 12, 2026 and is currently classified as a high‑risk brand‑impersonation campaign targeting users of the Phantom Wallet application. The site presents a page titled “Phantom Airdrop – Claim Your $PHANTOM Tokens”, indicating an attempt to lure victims with a fraudulent token distribution. The campaign is active and employs an airdrop‑style cryptocurrency scam kit. Infrastructure analysis shows that the domain resolves to IP address 64.29.17.195, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in the United States. The host is identified as Vercel, and the service presents an HSTS header, confirming the use of transport‑layer security. The TLS certificate is issued by Google Trust Services under the WR1 profile, and the server returns an HTTP 307 redirect, a pattern frequently observed in malicious redirect chains. Reputation signals reinforce the malicious assessment. The site is listed on three independent security blocklists and has been flagged by Google Safe Browsing with a SOCIAL_ENGINEERING warning. A Gridinsoft trust score of 0/100 further indicates an absence of legitimate trust. VirusTotal scanned the domain and 13 of 95 security vendors reported it as malicious. The phishing kit identified is an “Airdrop Scam”, and the brand target is explicitly Phantom Wallet, confirming the intent to impersonate that service. Defenders should block resolution of dropinfo.vercel.app at the DNS level and enforce web‑filter rules that deny HTTP redirects to the associated IP address. Network monitoring should alert on outbound connections to 64.29.17.195 and flag any TLS handshakes using the Google Trust Services / WR1 certificate originating from untrusted internal hosts. Users of Phantom Wallet should be warned that legitimate airdrops never require credential submission on external domains, and incident response teams should treat any related credential harvest attempts as compromise events.