flaredrops[.]vercel[.]app

Analysis of the domain flaredrops.vercel.app indicates it was a phishing site targeting users of the Flare brand, as evidenced by the page title 'Get FlareDrops | Flare'. The domain was registered on February 21, 2026, through Tucows Domains Inc. and resolved to the IP address 64.29.17.3, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The site employed an SSL certificate issued by Google Trust Services (WR1) and enforced HTTP Strict Transport Security (HSTS), suggesting an attempt to appear legitimate. At the time of assessment, the domain returned an HTTP 451 status, indicating it was taken offline, likely due to enforcement actions.

Detection data reveals that 8 of 93 security vendors on VirusTotal flagged the domain as malicious, while PhishDestroy and one additional security blocklist also listed it. Google Safe Browsing classified the domain under 'social engineering', further supporting its phishing classification. The site was built on Vercel's platform, a common choice for rapidly deployed phishing campaigns due to its ease of use and free hosting options.

While the exact content and mechanics of the phishing attempt remain unconfirmed due to the domain's offline status, the combination of the page title, detection flags, and hosting infrastructure strongly suggests it was designed to deceive users into divulging credentials or other sensitive information related to the Flare brand. Defenders should treat this domain as a confirmed phishing threat and ensure it is blocked at the network and endpoint levels. Monitoring for related domains or IP reuse is recommended, as threat actors often redeploy infrastructure across multiple campaigns.