chainlink[.]ltd

This domain, chainlink.ltd, is actively flagged as a high-risk phishing site targeting cryptocurrency users. Registered on May 25, 2026, through a hosting provider, the domain currently resolves to IP address 181.215.205.4, hosted on infrastructure associated with a private customer in the United Arab Emirates. The site returns an HTTP 301 redirect status, though the destination remains unclear, and presents an 'Account Suspended' page title, a common tactic to mimic legitimate service interruptions while harvesting credentials. Analysis indicates the domain is blocked by multiple security feeds, including three independent blocklists, and is flagged by four out of ninety-five security vendors on a widely used scanning platform. The SSL certificate, issued by a public certificate authority, uses a short-lived Let's Encrypt R13 chain, a pattern observed in transient phishing campaigns. Nameservers are hosted under ultahost.com, a provider frequently leveraged for bulletproof or low-cost hosting environments. While the exact phishing kit or targeted brand is not explicitly identified, the domain name closely resembles a well-known cryptocurrency oracle network, suggesting an intent to deceive users expecting legitimate service interactions. The combination of recent registration, cryptocurrency-themed branding, and active security vendor detections supports a high-risk classification. Defenders should treat this domain as malicious and prioritize blocking at the DNS, proxy, and endpoint levels. Network logs should be reviewed for connections to the IP or domain, particularly from systems handling cryptocurrency transactions or wallet management. No legitimate business use is known for this domain, and its continued resolution warrants immediate containment.