chainlink[.]airdrpalerts[.]lat

chainlink.airdrpalerts.lat was registered through Dynadot LLC and first observed on October 25, 2025. The domain resolves to the IP address 142.250.181.228, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. Nameserver records show brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS services. No TLS certificate is presented for the site, and the HTTP response returned a page whose title is “Google”, providing no direct indication of the advertised content.

The domain is classified as a brand‑impersonation campaign targeting Facebook, as indicated by the threat type and the explicit “Impersonates: Facebook” label. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal analysis recorded detections by 2 of 95 scanned security vendors, confirming that at least a minority of scanners flagged the domain as suspicious. The domain appears on one external security blocklist and has been blocked by the PhishDestroy service, demonstrating that community‑driven defenses have already taken action.

The overall risk rating is elevated, and the current operational status is offline, suggesting that the hosting has been taken down or the site is otherwise inaccessible. Defenders should continue to enforce deny‑list rules for the A or AAAA records of this domain, monitor the associated IP range for related activity, and consider adding the domain to internal blocklists. Ongoing surveillance of the Cloudflare nameservers and the Google‑owned IP address may reveal additional infrastructure reuse. Because the page title does not match the claimed brand, analysts should treat any future re‑registration of similar domains with heightened scrutiny.