chestme[.]com

Analysis of the domain chestme.com confirms its involvement in brand impersonation targeting the ME Foundation, with active scam operations as of July 12, 2026. The domain was registered on February 21, 2026, through DropCatch.com 544 LLC, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to IP address 172.67.178.22, hosted on Cloudflare's network (AS13335) in the United States. The site currently returns an HTTP 302 redirect status, a technique commonly used to obscure final landing pages or evade detection. No SSL certificate is present, further reducing the legitimacy of the domain. The domain is explicitly flagged for two scam types: airdrop scams and QR code hijacking. These methods typically involve luring victims with fraudulent cryptocurrency giveaways or redirecting them to malicious sites via manipulated QR codes. The page title displayed is 'ME Foundation,' directly mimicking the legitimate organization to deceive users. As of the latest intelligence, chestme.com appears on two security blocklists and is actively blocked by at least two threat intelligence platforms. VirusTotal reports that 4 out of 95 security vendors have flagged the domain as malicious, providing additional corroboration of its high-risk status. Defenders should prioritize blocking chestme.com at the DNS and network levels, particularly in environments where cryptocurrency-related activities or QR code interactions are common. The domain's nameservers, nsg1.namebrightdns.com and nsg2.namebrightdns.com, may also serve as indicators for broader infrastructure monitoring. While the exact payload or final destination of the 302 redirect remains uncertain, the combination of brand impersonation, lack of SSL, and confirmed scam classifications justifies immediate mitigation. Continuous monitoring is recommended, as the domain remains active and may evolve its tactics.