chz[.]airdropsalert[.]us

Analysis indicates that the domain chz.airdropsalert.us was registered through Dynadot LLC on 18 October 2025. The domain employs Cloudflare authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and resolves to the IP address 142.251.40.164, which belongs to AS15169 Google LLC and is geographically located in the United States. No TLS certificate was observed, meaning the site was served over plain HTTP. The page title returned by the server is the generic string “Google”, matching the declared brand target of Google and supporting the classification as a brand‑impersonation campaign.

Google Safe Browsing has listed the domain for social engineering, and VirusTotal reports that 13 of 93 scanned security vendors flagged the host as malicious. A Gridinsoft trust score of 0 / 100 further reflects the malicious nature. The domain appears on a single known security blocklist and has been actively blocked by the PhishDestroy feed. The listed scam type is “Crypto Scam”, suggesting that the payload likely attempts to lure victims into cryptocurrency‑related fraud, although the exact content of the landing page has not been disclosed.

The infrastructure is currently offline, but the historical evidence demonstrates a clear pattern of abuse aimed at exploiting the Google brand to deceive users. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑use of the underlying IP address or Cloudflare nameservers, and incorporate the domain’s indicators into threat‑intel feeds. Further investigation is required to capture the phishing page content and any associated command‑and‑control endpoints, which remain unknown at this time.