chainlink[.]airdropsalert[.]icu

The domain chainlink.airdropsalert.icu was registered on 17 October 2025 through Dynadot LLC. It is configured to use the Cloudflare authoritative name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com and resolves to the IPv4 address 192.178.155.147, which is owned by AS15169 Google LLC and geolocated in the United States. No TLS certificate is presented, indicating that the site only served HTTP content. The only visible page element captured in the intelligence is the HTML title “Google”, matching the declared brand target and confirming a Google brand impersonation attempt.

VirusTotal records show that 14 of 95 scanning engines flagged the domain as malicious, and Google Safe Browsing classifies it as a social‑engineering threat. The domain appears on a single external blocklist and is listed as blocked by PhishDestroy. The site was associated with a “Fake Airdrop” scam type, suggesting that it attempted to lure victims with a counterfeit cryptocurrency airdrop tied to the Google brand.

As of the report date the domain is taken offline, but the infrastructure – Cloudflare DNS and a Google‑owned IP address – could be reused for future campaigns. Defenders should continue to block the domain at the DNS level, add the IP address to outbound filtering rules, and monitor for similar Cloudflare‑hosted domains that resolve to Google AS numbers. Additional threat‑intel feeds should be consulted for any resurgence, and any email or web traffic that references the “airdropsalert” sub‑domain should be treated as suspicious.