chainlink[.]airdropsalert[.]lol

Analysis of chainlink.airdropsalert.lol shows that the domain was registered on 18 October 2025 through Dynadot LLC and is currently taken offline. The domain resolves to IP address 64.233.180.147, which belongs to AS15169 Google LLC and is geolocated in the United States. Despite the IP belonging to Google’s infrastructure, the site does not present a valid TLS certificate, indicating that HTTPS connections are not protected. The page title returned by the server is “Google”, matching the declared brand target of Google and confirming the intent to impersonate the search giant.

Google Safe Browsing has flagged the domain for social engineering, and 13 of 95 security vendors on VirusTotal have raised alerts, reinforcing the malicious classification. The malicious activity is identified as a “Fake Airdrop” scam, a common vector used to lure victims with promises of cryptocurrency distributions. The domain appears on a single security blocklist, specifically PhishDestroy, and its authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both hosted by Cloudflare. Evidence indicates that the infrastructure was deliberately set up to mimic a legitimate Google page in order to deceive users, but the lack of SSL and the offline status suggest that the campaign may have been disrupted or abandoned.

Uncertainty remains regarding any active payload or credential harvesting mechanisms because the site was not captured while live, and no additional indicators such as malicious files or redirects have been disclosed. Defenders should continue to block the domain at DNS and web proxy layers, monitor for any resurgence of the same hostnames or IP address, and add the associated IP and name server pair to reputation lists. Because the IP resides within Google’s network, any future abuse from this address should be reported to Google’s abuse contacts to facilitate rapid takedown.