chainlink[.]airdrpsalert[.]sbs

Analysis shows that the domain chainlink.airdrpsalert.sbs was registered on October 22, 2025 through Dynadot LLC and is configured with Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The site resolves to the IPv4 address 216.58.206.36, which belongs to AS15169 operated by Google LLC and is geolocated in Germany. No TLS certificate is presented, indicating that the service is served over HTTP only. The page title returned from the host is the literal string "Google", and the domain is explicitly classified as a brand impersonation campaign targeting Google.

Reputation services reflect extreme distrust: Scamadviser assigns a score of 1 out of 100 and Gridinsoft reports 0 out of 100. VirusTotal scans have yielded detections from eight of ninety‑five antivirus or URL analysis engines, and the domain appears on one external security blocklist. The phishing‑focused blocklist PhishDestroy has already listed the domain, and the current operational status is offline – the site has been taken down as of the reporting date, July 25, 2026. Defenders should treat the indicator as high‑confidence evidence of a malicious brand‑impersonation infrastructure.

Immediate actions include adding chainlink.airdrpsalert.sbs to local deny lists, confirming that any residual DNS entries are blocked at the recursive resolver level, and monitoring for re‑use of the underlying IP address or the associated Cloudflare name servers. Because the domain resolves to a Google‑owned IP, any future activation could bypass typical external reputation checks that rely on IP reputation alone, so detection rules should incorporate the fully qualified domain name and the observed name‑server pair. Continuous verification of the domain’s SSL status is advised; the absence of a certificate may change if the operators later deploy TLS to increase credibility.