kryptolenta[.]site

The domain kryptolenta.site has been identified as a high-risk threat due to brand impersonation activities targeting Chainlink. The website, titled 'Крипто Новости', was designed to mimic legitimate content associated with Chainlink, aiming to deceive users into divulging sensitive information or engaging with malicious content. This threat type is particularly concerning given the potential for significant financial and reputational damage to the targeted brand.

Technical analysis of kryptolenta.site reveals several critical indicators. The domain was created on November 30, 2025, and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 92.53.96.141, located in Russia under AS9123 JSC TIMEWEB. Notably, the domain lacks an SSL certificate, further underscoring its illegitimacy. The domain is flagged by Google Safe Browsing as phishing and appears on one security blocklist. VirusTotal analysis shows that 10 out of 95 security vendors have flagged this domain as malicious.

Currently, the domain kryptolenta.site is offline, and it has been blocked by PhishDestroy. Despite its offline status, the domain's previous activities highlight the ongoing risk of similar impersonation threats. Organizations and users should remain vigilant, employing comprehensive security solutions and user education to mitigate the risk of falling victim to such scams. Continuous monitoring of brand mentions and rapid response to newly identified threats can further reduce exposure to similar attacks.