Audit log

Every state-changing event for Google Coin / Fake Gemini AI Chatbot Presale Scam: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-06-03 01:37:47Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 423,928,591

   sig

   4qKConkdzNHG…dHgvZATjcopyexplorer ↗

   hash

   6r5huAKtffF5…A2Q8oaPAcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (18820 B) ▸

   {"actor":"system:backfill","investigation_id":"a7424c5a-dc18-45a7-abdf-76e66fe798a6","kind":"publish","page_slug":"google-coin-fake-gemini-ai-chatbot-presale-scam","published_at":"2026-06-03T01:37:47.485Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Google Coin / Fake Gemini AI Chatbot Presale Scam","sections":[{"content":"On February 18, 2026, Malwarebytes researcher Stefan Dasic published a detailed technical analysis of a live fraudulent cryptocurrency presale site promoting 'Google Coin,' a token that does not exist and has no affiliation with Alphabet Inc. or Google LLC. The site was discovered by Malwarebytes Labs and subsequently covered by Fox News, TechRepublic, Dark Reading, Consumer Affairs, and Security Boulevard. The operation combined three well-documented fraud vectors: brand impersonation of a globally recognized technology company, AI-driven persuasion automation operating 24/7 without human operators, and irreversible cryptocurrency payment rails designed to prevent recovery of victim funds. No regulatory enforcement action against the operators had been publicly reported as of June 2026.","heading":"Overview and Discovery","severity":"critical","sources":[{"credibility":2,"name":"Scammers use fake 'Gemini' AI chatbot to sell fake 'Google Coin' — Malwarebytes Labs","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"credibility":2,"name":"Fake Gemini AI Chatbot Promotes 'Google Coin' in New Crypto Scam — TechRepublic","type":"news_article","url":"https://www.techrepublic.com/article/news-fake-google-coin-scam-ai-chatbot-gemini/"},{"credibility":2,"name":"Malwarebytes uncovers fake Google Coin crypto scam using AI chatbot — Fox News","type":"news_article","url":"https://www.foxnews.com/tech/fake-google-gemini-ai-pushes-google-coin-crypto-scam"},{"credibility":2,"name":"Scam Abuses Gemini Chatbots to Convince People to Buy Fake Crypto — Dark Reading","type":"news_article","url":"https://www.darkreading.com/endpoint-security/scam-abuses-gemini-chatbots-convince-people-buy-fake-crypto"}]},{"content":"The fraudulent website closely mimicked Google's visual identity, incorporating the 'G' logo, Google's color palette, polished navigation menus, and a presale dashboard styled to resemble a legitimate crypto launch platform. A chatbot embedded on the site was designed to impersonate Google's actual Gemini AI product: it used the Gemini sparkle icon, displayed a green 'Online' status indicator, and identified itself as 'the official helper for the Google Coin platform.' According to Malwarebytes, the site displayed a 'Trusted By Industry' banner listing logos and names of OpenAI, Google, Binance, Coinbase, Squarespace, and SpaceX — none of which have any connection to the project. The fraudulent chatbot also referenced a fictional 'Google-Chain' blockchain network as the underlying infrastructure for the token. Fox News reported it reached out to Google for comment but received no response before its publication deadline.","heading":"Brand Impersonation and Website Design","severity":"critical","sources":[{"credibility":2,"name":"Scammers use fake 'Gemini' AI chatbot to sell fake 'Google Coin' — Malwarebytes Labs","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"credibility":2,"name":"Malwarebytes uncovers fake Google Coin crypto scam using AI chatbot — Fox News","type":"news_article","url":"https://www.foxnews.com/tech/fake-google-gemini-ai-pushes-google-coin-crypto-scam"}]},{"content":"The embedded chatbot operated entirely on a scripted sales loop. Malwarebytes documented that the bot consistently returned to a fixed set of selling points — a 'detailed 2026 roadmap,' 'military-grade encryption,' 'AI integration,' and a 'growing community of investors' — regardless of the question asked. When pressed on regulatory licensing, audit reports, or the identity of the company behind the project, the bot deflected inquiries, dismissed skepticism, and redirected users to unnamed 'managers.' Unlike some AI systems that can be pushed off-script, this chatbot looped persistently back to its conversion objective. Researchers noted that the chatbot could engage hundreds of users simultaneously, 24 hours a day, delivering personalized-seeming responses with no human operators required. TechRepublic noted that the operation reflects a broader pattern in which AI eliminates the scalability bottleneck of human-staffed fraud call centers.","heading":"AI Chatbot Mechanics and Scripted Sales Funnel","severity":"critical","sources":[{"credibility":2,"name":"Scammers use fake 'Gemini' AI chatbot to sell fake 'Google Coin' — Malwarebytes Labs","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"credibility":2,"name":"Fake Gemini AI Chatbot Used in Crypto Scam — TechRepublic","type":"news_article","url":"https://www.techrepublic.com/article/news-scammers-use-fake-gemini-ai-chatbot-crypto-scam/"}]},{"content":"The chatbot provided specific, personalized financial projections when asked investment questions. When queried about purchasing 100 tokens, it stated that a $395 investment at the presale price of $3.95 per token would be worth $2,755 at listing — representing 'approximately 7x' growth. The advertised listing price was $27.55 per token. A tiered bonus structure was promoted alongside: 5% bonus for 100-token purchases, scaling to 30% for purchases of 100,000 tokens. The site presented a 'Stage 5 of 5' presale dashboard with a counter claiming over 9.9 million tokens had already been sold, and listed February 18, 2026 as the hard listing deadline — manufacturing urgency. No token contract address, exchange listing agreement, smart contract audit, or independent financial verification was provided. Malwarebytes characterized these projections as scripted persuasion rather than financial information, noting that no legitimate investment product can guarantee a specific future price.","heading":"Fabricated Return Projections and Presale Claims","severity":"critical","sources":[{"credibility":2,"name":"Scammers use fake 'Gemini' AI chatbot to sell fake 'Google Coin' — Malwarebytes Labs","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"credibility":2,"name":"If a bot tries to sell you a new 'Google Coin,' it's a scam — Consumer Affairs","type":"news_article","url":"https://www.consumeraffairs.com/news/if-a-bot-tries-to-sell-you-a-new-google-coin-its-a-scam-021926.html"}]},{"content":"Victims who proceeded with a purchase were directed to a fake wallet dashboard displaying balances denominated in 'Google' tokens on the fictional 'Google-Chain,' alongside Bitcoin and Ethereum. The purchase flow generated a cryptocurrency payment request tied to a specific wallet address; all payments were irreversible. Malwarebytes identified six cryptocurrency wallet addresses used across multiple blockchain networks. As published in the February 18, 2026 research: Ethereum — 0xEc7a42609D5CC9aF7a3dBa66823C5f9E5764d6DA; Solana — 98388xymWKS6EgYSC9baFuQkCpE8rYsnScV4L5Vu8jt; Bitcoin (legacy format) — DHyDmJdr9hjDUH5kcNjeyfzonyeBt19g6G; TRON — TWqzJ9sF1w9aWwMevq4b15KkJgAFTfH5im; Bitcoin (bech32 native SegWit) — bc1qw0yfcp8pevzvwp2zrz4pu3vuygnwvl6mstlnh6; XRP Ledger — r9BHQMUdSgM8iFKXaGiZ3hhXz5SyLDxupY. The multi-chain payment infrastructure was designed to accommodate victims regardless of which network they held funds on. No public on-chain flow analysis of inflows to these addresses was available from Tier 1 or Tier 2 sources at the time of this investigation.","heading":"Payment Infrastructure and Indicators of Compromise","severity":"critical","sources":[{"credibility":2,"name":"Scammers use fake 'Gemini' AI chatbot to sell fake 'Google Coin' — Malwarebytes Labs (IOCs)","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"}]},{"content":"The operators of this fraud operation remain unidentified as of June 2026. The scam site provided no verifiable company details, registered legal entity, regulatory license, or official contact information. The chatbot was scripted to refuse any questions that might reveal the true nature of the operation or provide auditable credentials. Malwarebytes did not publicly disclose the site's domain name in its published analysis. No law enforcement action against specific individuals has been publicly announced. The automated, chatbot-driven architecture of the operation reduced the need for human operators, consistent with Chainalysis findings on AI-enabled fraud operations maintaining a minimal human footprint.","heading":"Operator Identity and Attribution","severity":"high","sources":[{"credibility":2,"name":"Scammers use fake 'Gemini' AI chatbot to sell fake 'Google Coin' — Malwarebytes Labs","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"credibility":2,"name":"Fake Gemini AI Chatbot Promotes 'Google Coin' in New Crypto Scam — TechRepublic","type":"news_article","url":"https://www.techrepublic.com/article/news-fake-google-coin-scam-ai-chatbot-gemini/"}]},{"content":"The Google Coin operation reflects a documented and accelerating trend in AI-automated brand impersonation fraud. Chainalysis reported in January 2026 that impersonation scams surged 1,400% year-over-year in 2025, and that AI-enabled scams were approximately 4.5 times more profitable than traditional tactics. Roughly 60% of all funds flowing into crypto scam wallets in 2025 were tied to scammers using AI tools. The FBI's 2025 Internet Crime Complaint Center (IC3) report documented $11 billion in reported cryptocurrency fraud losses from 181,565 complaints, with investment fraud accounting for nearly half of all scam-related losses. The Google Coin operation — with its ability to engage hundreds of potential victims simultaneously, 24 hours a day, without human operators — is consistent with the industrialized AI-fraud model documented in these reports. Chainalysis and CoinDesk noted this pattern surpassed cyberattacks as the dominant vector of crypto-related financial crime.","heading":"Broader Context: AI-Powered Impersonation Fraud Surge","severity":"high","sources":[{"credibility":2,"name":"Chainalysis: Impersonation and AI scams are becoming crypto's biggest threat — CoinDesk","type":"research","url":"https://www.coindesk.com/business/2026/01/14/chainalysis-report-reveals-impersonation-and-ai-crypto-scams-surpass-cyberattacks"},{"credibility":1,"name":"Cryptocurrency and AI Scams Bilk Americans of Billions — FBI","type":"regulatory","url":"https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions"},{"credibility":1,"name":"FBI IC3 Report: Half of 2025 U.S. Fraud Losses Were Linked to Cryptocurrency Scams — ASIS","type":"regulatory","url":"https://www.asisonline.org/security-management-magazine/latest-news/today-in-security/2026/april/cryptocurrency-scams/"},{"credibility":2,"name":"Chainalysis: AI drives impersonation scams up 1,400% — Cyber Magazine","type":"research","url":"https://cybermagazine.com/news/chainalysis-inside-lighthouse-phishing-as-a-service-scams"}]},{"content":"As of June 2026, no SEC, FTC, DOJ, or international law enforcement action against the operators of the Google Coin presale site has been publicly reported. The identities of the operators remain unknown. Malwarebytes did not disclose the site's domain name in its published article. Consumer advocacy outlets directed victims to report incidents to the FTC at reportfraud.ftc.gov and the FBI's Internet Crime Complaint Center at ic3.gov. The California Department of Financial Protection and Innovation (DFPI) maintains a public Crypto Scam Tracker that accepts consumer reports of this type. Victims of irreversible cryptocurrency transfers have no effective recourse through traditional financial dispute resolution channels.","heading":"Regulatory and Law Enforcement Status","severity":"medium","sources":[{"credibility":1,"name":"Cryptocurrency Scams — Federal Trade Commission","type":"regulatory","url":"https://www.ftc.gov/media/cryptocurrency-scams"},{"credibility":1,"name":"Crypto Scam Tracker — California DFPI","type":"regulatory","url":"https://dfpi.ca.gov/consumers/crypto/crypto-scam-tracker/"}]}],"sources_used":[{"credibility":2,"name":"Scammers use fake 'Gemini' AI chatbot to sell fake 'Google Coin' — Malwarebytes Labs","type":"research","url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"credibility":2,"name":"Fake Gemini AI Chatbot Promotes 'Google Coin' in New Crypto Scam — TechRepublic","type":"news_article","url":"https://www.techrepublic.com/article/news-fake-google-coin-scam-ai-chatbot-gemini/"},{"credibility":2,"name":"Fake Gemini AI Chatbot Used in Crypto Scam — TechRepublic","type":"news_article","url":"https://www.techrepublic.com/article/news-scammers-use-fake-gemini-ai-chatbot-crypto-scam/"},{"credibility":2,"name":"Malwarebytes uncovers fake Google Coin crypto scam using AI chatbot — Fox News","type":"news_article","url":"https://www.foxnews.com/tech/fake-google-gemini-ai-pushes-google-coin-crypto-scam"},{"credibility":2,"name":"Scam Abuses Gemini Chatbots to Convince People to Buy Fake Crypto — Dark Reading","type":"news_article","url":"https://www.darkreading.com/endpoint-security/scam-abuses-gemini-chatbots-convince-people-buy-fake-crypto"},{"credibility":2,"name":"If a bot tries to sell you a new 'Google Coin,' it's a scam — Consumer Affairs","type":"news_article","url":"https://www.consumeraffairs.com/news/if-a-bot-tries-to-sell-you-a-new-google-coin-its-a-scam-021926.html"},{"credibility":2,"name":"Scammers use fake 'Gemini' AI chatbot to sell fake 'Google Coin' — Security Boulevard","type":"news_article","url":"https://securityboulevard.com/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin/"},{"credibility":3,"name":"Fake Gemini bot pushes Google Coin in AI scams surge — The Bit Gazette","type":"news_article","url":"https://thebitgazette.com/fake-gemini-bot-lured-crypto-investors-with-fabricated-google-coin-presale-promising-7x-returns/"},{"credibility":2,"name":"Chainalysis: Impersonation and AI scams are becoming crypto's biggest threat — CoinDesk","type":"research","url":"https://www.coindesk.com/business/2026/01/14/chainalysis-report-reveals-impersonation-and-ai-crypto-scams-surpass-cyberattacks"},{"credibility":2,"name":"AI-Powered Crypto Scams: How AI is Being Used for Fraud — Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/ai-artificial-intelligence-powered-crypto-scams/"},{"credibility":1,"name":"Cryptocurrency and AI Scams Bilk Americans of Billions — FBI","type":"regulatory","url":"https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions"},{"credibility":1,"name":"FBI IC3 Report: Half of 2025 U.S. Fraud Losses Were Linked to Cryptocurrency Scams — ASIS","type":"regulatory","url":"https://www.asisonline.org/security-management-magazine/latest-news/today-in-security/2026/april/cryptocurrency-scams/"},{"credibility":1,"name":"Cryptocurrency Scams — Federal Trade Commission","type":"regulatory","url":"https://www.ftc.gov/media/cryptocurrency-scams"},{"credibility":1,"name":"Crypto Scam Tracker — California DFPI","type":"regulatory","url":"https://dfpi.ca.gov/consumers/crypto/crypto-scam-tracker/"},{"credibility":2,"name":"Chainalysis: AI drives impersonation scams up 1,400% — Cyber Magazine","type":"research","url":"https://cybermagazine.com/news/chainalysis-inside-lighthouse-phishing-as-a-service-scams"}],"summary":"In February 2026, Malwarebytes researcher Stefan Dasic documented a live fraudulent cryptocurrency presale site promoting a non-existent token called 'Google Coin.' The operation deployed a custom AI chatbot impersonating Google's Gemini assistant — using its sparkle icon, green 'Online' indicator, and name — to deliver scripted investment pitches, fabricated institutional endorsements from OpenAI, Binance, Coinbase, Squarespace, and SpaceX, and personalized return projections (e.g. $395 presale investment projected to become $2,755 at listing). Victims were directed to send irreversible cryptocurrency payments to six wallets spanning Bitcoin, Ethereum, Solana, TRON, and XRP Ledger. Google has never issued a cryptocurrency; the token, the chatbot persona, and all associated endorsements were entirely fabricated.","timeline":[{"date":"2026-01-14","event":"Chainalysis published its 2026 Crypto Crime Report documenting 1,400% year-over-year growth in impersonation scams and approximately $17 billion in total crypto scam losses for 2025, establishing the broad industry context for the Google Coin operation.","source":"CoinDesk / Chainalysis","source_url":"https://www.coindesk.com/business/2026/01/14/chainalysis-report-reveals-impersonation-and-ai-crypto-scams-surpass-cyberattacks"},{"date":"2026-02-18","event":"Malwarebytes researcher Stefan Dasic published analysis of the live Google Coin presale site operating a fake Gemini AI chatbot. The site itself displayed February 18 as its advertised token listing deadline. Six cryptocurrency wallet addresses across Ethereum, Solana, Bitcoin, TRON, and XRP Ledger were identified as indicators of compromise.","source":"Malwarebytes Labs","source_url":"https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin"},{"date":"2026-02-19","event":"Consumer Affairs published a consumer advisory warning about the Google Coin scam and directing potential victims to file reports with the FTC and FBI IC3.","source":"Consumer Affairs","source_url":"https://www.consumeraffairs.com/news/if-a-bot-tries-to-sell-you-a-new-google-coin-its-a-scam-021926.html"},{"date":"2026-02-19","event":"Dark Reading and TechRepublic published secondary coverage of the Malwarebytes findings, amplifying security community awareness of the fraud pattern.","source":"Dark Reading / TechRepublic","source_url":"https://www.darkreading.com/endpoint-security/scam-abuses-gemini-chatbots-convince-people-buy-fake-crypto"},{"date":"2026-03-09","event":"Fox News published broader consumer-facing coverage of the scam, noting that Google did not respond to a request for comment before the publication deadline.","source":"Fox News","source_url":"https://www.foxnews.com/tech/fake-google-gemini-ai-pushes-google-coin-crypto-scam"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ea6e49b0-1f7b-41a2-8289-bc564eb19f1fcopy