chainlink[.]airdrpsalerts[.]info

The domain chainlink.airdrpsalerts.info was observed hosting a brand‑impersonation page that presented the title “Google”. The site lacked an SSL certificate, indicating unencrypted HTTP service. Registration information shows the domain was provisioned through Cloudflare, Inc., but the authoritative name server data could not be retrieved (NS_NOT_FOUND). DNS resolution returned the address 172.253.62.106, which belongs to Google’s AS15169 infrastructure in the United States. Despite the IP belonging to Google, the domain is not owned by Google and is being used to masquerade as the company. The page title alone confirms the intent to impersonate Google; no additional page content has been captured.

Threat‑intelligence feeds flag the domain as malicious. Twelve of ninety‑five VirusTotal scanners raised detections, and the domain appears on a single external blocklist. PhishDestroy has actively blocked the host, and the Gridinsoft trust score is 0 out of 100, indicating an extremely low reputation. The overall classification is “Brand Impersonation” targeting Google. The site is currently offline, which may be the result of takedown actions or temporary hosting changes.

Uncertainties remain regarding the exact phishing kit or payload used, as no code samples or URL paths were collected. The lack of SSL prevents verification of any credential‑capture forms, and the missing name‑server records limit attribution of the underlying registration entity. Defenders should continue to monitor for re‑appearance of the domain or related sub‑domains, enforce blocklists that include this host, and ensure web‑filtering solutions reference the current detection data (VirusTotal, PhishDestroy, Gridinsoft). Endpoint detection and response (EDR) policies should be tuned to alert on outbound connections to 172.253.62.