chainlink[.]airsdropsalert[.]lol

Analysis of chainlink.airsdropsalert.lol shows a brand‑impersonation campaign targeting Google users. The domain was registered on 5 November 2025 through Dynadot LLC and currently resolves to the IP address 172.217.18.4, which is owned by Google (ASN 15169) in the United States. The site is hosted behind Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate is presented, indicating that the service is reachable only over plain HTTP. The page title returned from the host is simply "Google," matching the declared brand target.

Gridinsoft assigns a trust score of 0 / 100, and eight of ninety‑five VirusTotal scanners flag the domain as malicious. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole. The infrastructure footprint is minimal, with the only observable artifact being the Google‑owned IP, which may cause incidental overlap with legitimate traffic. Defenders should deny any DNS resolution to this fully qualified domain name, add it to local and network‑level blocklists, and monitor for any future re‑registration attempts.

Because the host resolves to a legitimate Google address, security solutions that rely solely on IP reputation may miss this threat; therefore, correlation with domain‑level indicators such as the Cloudflare name servers, lack of SSL, and the low trust score is essential. The elevated risk rating reflects the combination of brand impersonation, confirmed malicious flagging, and the potential for credential‑ harvesting against Google users. Continuous observation of the registrar Dynadot for repeat abuse and periodic re‑scans of the domain are recommended to maintain up‑to‑date defensive posture.