airdropchime[.]com

Analysis of airdropchime.com, created on February 21, 2026, shows a confirmed crypto‑draining operation. The site was identified as a crypto scam and associated with the publicly observed “Airdrop Scam” phishing kit. The page title returned by the server was “Airdrop Bell – Never Miss a Crypto Airdrop,” which aligns with the advertised lure of free token drops. Infrastructure inspection reveals that the domain resolved to IP address 188.114.96.3, a host owned by Cloudflare (AS13335) located in the United States.

The domain employed Cloudflare’s DNS service, using the nameservers junade.ns.cloudflare.com and kira.ns.cloudflare.com, and was served over HTTP/3 with an SSL certificate issued by Google Trust Services under the WE1 label. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, indicating maximal suspicion. The domain appears on a single security blocklist and was actively blocked by the PhishDestroy service before being taken offline. VirusTotal analysis recorded a single positive detection out of 93 scanning engines, confirming that at least one vendor flagged the site as malicious.

Registration was performed through NameCheap, Inc., a common registrar for malicious actors. The combination of a low trust score, a known phishing kit, a Cloudflare‑hosted IP, and a positive VirusTotal flag provides strong evidence of a crypto‑drainer campaign. Defenders should add airdropchime.com to URL filtering and DNS blocklists, monitor the associated IP address for any re‑use, and consider updating intrusion‑detection signatures to detect traffic to the identified Cloudflare nameservers. Continuous observation of the registrar’s newly created domains is advised, as the rapid creation date suggests a short‑lived infrastructure typical of crypto‑drain attacks.