linkcollect[.]org

Analysis indicates that the domain linkcollect.org is actively engaged in brand impersonation, specifically targeting the Aave brand. The domain was registered through NiceNIC International Group Co., Limited on July 10, 2025, and has been flagged by multiple security vendors. The page title 'Chainlink: The Industry-Standard Oracle Platform' does not align with the Aave brand, suggesting that the domain may be attempting to mislead visitors by impersonating a different entity. This discrepancy is a common tactic used in phishing and scam operations to gain trust and extract sensitive information from users. The domain is currently active and resolves to the IPv6 address 2620:cb:2000::1. It is important to note that the SSL certificate is issued by Google Trust Services, which may be used to create a false sense of security among users. The domain has been included in 24 threat intelligence pulses on AlienVault OTX and appears on two security blocklists, further confirming its malicious nature. While 5 out of 95 security vendors flag this domain on VirusTotal, this mixed result does not necessarily indicate safety or danger, but it does highlight the need for caution. Defenders should consider blocking this domain and conducting further investigation to understand the specific techniques and payloads being used. Users should avoid interacting with this domain and report any suspicious activities to their security teams.