backpack-airdrop[.]vercel[.]app

Analysis indicates that backpack-airdrop.vercel.app is an active fraudulent domain targeting cryptocurrency users through a fake airdrop scheme. The domain, created on March 28, 2026, presents itself as a 'Backpack Airdrop 2025 — Claim Your XNFT' platform, a clear attempt to deceive users into engaging with a crypto drainer. Infrastructure analysis reveals the domain is hosted on Vercel infrastructure, resolving to IP address 216.198.79.3, associated with Lefkoff Industries in the United States. The SSL certificate is issued by Google Trust Services, a common but not inherently suspicious provider. The domain is explicitly flagged by multiple security vendors, including PhishDestroy, MetaMask, SEAL, and ScamSniffer, and appears on four security blocklists. Despite being scanned by 94 vendors, no detections are currently reported, though this absence does not confirm safety. The domain employs HSTS, a security feature that, while legitimate, is also utilized by threat actors to lend credibility to malicious sites. Given the domain's association with a known airdrop phishing kit and its active status as of July 12, 2026, defenders should treat this as a high-risk threat. Network-level blocking is recommended, particularly for environments where cryptocurrency transactions occur. The lack of nameserver records (NS_NOT_FOUND) may indicate an attempt to obscure ownership or hosting details, further supporting the assessment of malicious intent. No legitimate airdrop campaign would operate under such conditions, and users should avoid interaction with this domain entirely.