chainlink[.]airdropsalert[.]life

Analysis of the domain chainlink.airdropsalert.life indicates a high-risk brand impersonation campaign targeting Google users through a fraudulent airdrop scheme. The domain was registered on October 17, 2025, via Dynadot LLC and resolved to the IP address 192.178.155.104, hosted under AS15169 (Google LLC) in the United States. Despite the hosting infrastructure, the domain exhibited no SSL certificate, a common red flag for phishing sites. The page title was explicitly set to 'Google,' aligning with the confirmed brand impersonation of Google, and the scam type was classified as a fake airdrop.

Detection data reveals the domain was flagged by 13 of 95 security vendors on VirusTotal, though the specific detection categories remain unconfirmed. It was also listed on one security blocklist and blocked by PhishDestroy. Google Safe Browsing classified the domain under 'social engineering' threats, reinforcing its malicious intent. As of July 23, 2026, the domain is offline, but historical infrastructure analysis suggests it was operational long enough to pose a credible threat.

Defenders should treat this domain as part of a broader pattern of airdrop-themed phishing targeting cryptocurrency or tech-savvy users. The lack of SSL, combined with the hosting provider mismatch (Google LLC infrastructure used for malicious purposes), highlights the need for continuous monitoring of domains leveraging trusted ASNs. Organizations should ensure blocklists are updated to include this domain and conduct retrospective log analysis to identify potential prior exposure. Given the domain's registration age and detection history, it may resurface under altered infrastructure or similar naming conventions.