chaingpt[.]airdropalerts[.]icu

Analysis date: July 23, 2026. The domain chaingpt.airdropalerts.icu was registered through Dynadot LLC on October 14, 2025 and currently resolves to IP 142.250.184.196, which belongs to AS15169 Google LLC in the United States. The domain uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com and presents no SSL certificate, meaning the site is served over plain HTTP. The page title returned from the host is the word “Google”, matching the declared brand target.

VirusTotal reports that 15 of 95 scanned security vendors flag the domain as malicious. Google Safe Browsing classifies the site under social engineering, and the domain appears on one public blocklist and is specifically blocked by PhishDestroy. Scam type is identified as a “Fake Airdrop”, indicating the site is likely used to lure victims with a purported cryptocurrency airdrop tied to the Google brand. Scamadviser assigns a trust score of 1/100, reflecting extreme lack of credibility.

The domain’s current status is taken offline, but the infrastructure—Google‑owned IP address and Cloudflare DNS—could be reused for future campaigns. Evidence of payloads, credential‑stealing forms, or redirects is not publicly available, leaving the exact attack vector uncertain. Defenders should add chaingpt.airdropalerts.icu to URL filtering blocks, monitor for similar airdrop‑related domains impersonating Google, and enforce strict TLS inspection policies to catch the absence of SSL. Monitoring for new registrations that combine “airdrop” and Google‑related terms is also recommended.