chainlink[.]airdrpalerts[.]lol

Analysis of the domain chainlink.airdrpalerts.lol indicates that it was created on October 25, 2025 and is currently marked as offline. The domain resolves to the IP address 142.250.184.196, which belongs to AS15169 Google LLC and is geolocated in the United States. The hosting service is provided by Cloudflare, as evidenced by the authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Registration was performed through Dynadot LLC, a registrar known to host both legitimate and malicious domains.

No SSL certificate was observed for the site, suggesting that any HTTP traffic would be unencrypted. The page title returned by the server is "Google," and the threat classification is listed as brand impersonation targeting the Google brand. The domain received a Gridinsoft trust score of 0 out of 100 and appears on a single security blocklist. It has been blocked by the PhishDestroy service, and two of ninety‑five VirusTotal security vendors flagged the domain, providing limited but notable detection.

The overall risk rating is elevated, reflecting the combination of impersonation, low trust score, and partial detection. Uncertainty remains regarding the specific payload or phishing page content, as no SSL or detailed page analysis is available. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat intelligence feeds, and monitor for any resurgence of the domain or related subdomains. Additional scrutiny of traffic to the associated IP address is advised, given its affiliation with a major cloud provider and potential for abuse.