chaingpt[.]airdropalerts[.]bond

Analysis of the domain chaingpt.airdropalerts.bond indicates a high-risk brand impersonation campaign targeting Google, classified as a fake airdrop scam. The domain was registered on October 14, 2025, through Dynadot LLC and is currently offline. Infrastructure analysis reveals resolution to IP 216.58.206.36, geolocated in Germany under AS15169 (Google LLC), though this does not confirm legitimate affiliation. The domain lacks an SSL certificate, increasing susceptibility to interception. Nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com suggest Cloudflare hosting, a common tactic to obscure origin and evade takedowns.

Detection data shows 10 of 95 security vendors on VirusTotal flagging the domain, while Google Safe Browsing explicitly marks it for social engineering. The domain appears on one security blocklist, and Scamadviser assigns a trust score of 1/100. The page title 'Google' aligns with the reported brand impersonation, though no further content analysis is available. No phishing kit or additional artifacts have been identified in the provided intelligence.

Defenders should treat this domain as malicious due to confirmed brand impersonation, social engineering flags, and multi-vendor detections. The absence of SSL and low trust scores further support blocking or monitoring. While the domain is offline, historical resolution to a Google-associated IP warrants scrutiny of related infrastructure. No evidence links this domain to legitimate Google services, and the registration date suggests recent malicious intent.