chainversedrop[.]com

Analysis of chainversedrop.com shows a short‑lived infrastructure dedicated to a fake airdrop campaign. The domain was registered on February 21, 2026 through Ultahost, Inc. and uses four Ultahost nameservers (ns1‑ns4.ultahost.com). DNS resolution points to IP address 159.100.6.5, which belongs to AS214036 Ultahost, Inc. in Germany. No TLS certificate is presented, indicating the site was served over plain HTTP. The page title returned by the server reads “Aura Pocket - We are here to help you resolve your crypto related issues,” confirming the intent to lure cryptocurrency users.

VirusTotal scans flagged the domain by nine of ninety‑three security vendors, providing modest but notable detection. The domain appears on two independent blocklists—PhishDestroy and ScamSniffer—further corroborating its malicious classification. Reputation services assign extremely low scores: Scamadviser rates it 1 / 100 and Gridinsoft 0 / 100, reflecting a high likelihood of fraud. The site is currently offline, limiting direct content analysis, and no SSL certificate or additional metadata is available.

The brand target is listed as “across,” suggesting the operation may have been intended to impersonate multiple brands, but concrete brand identifiers beyond the generic crypto wording are absent. Defenders should add chainversedrop.com to URL filtering policies, block its IP address at network perimeters, and ensure DNS resolvers deny queries for the domain. Continuous monitoring of the associated IP range and the Ultahost hosting environment is advisable, as the operator may redeploy similar campaigns under new domains. Organizations should educate users about unsolicited airdrop offers and reinforce the policy of never entering private keys on unverified sites.