chain-rise[.]ltd

The domain chain-rise.ltd has been identified as a generic phishing site impersonating the legitimate cryptocurrency platform Chain-Rise.org. Analysis indicates the domain is currently marked as taken_down, though prior activity suggests malicious intent targeting users of the authentic service. The threat type is classified as generic_phishing, with no evidence of malware distribution or advanced persistent threats at this time. Infrastructure analysis reveals the domain was registered on May 5, 2026, through Dynadot Inc, an uncommon registrar for this type of fraudulent activity. It resolves to the IP address 163.61.188.9 and is flagged by 13 of 95 security vendors on VirusTotal, with a presence on one additional security blocklist. Trust scores from Gridinsoft and Scamadviser are 0/100 and 1/100, respectively, indicating high confidence in its malicious classification. The site employs WordPress, MySQL, PHP, LiteSpeed, and several JavaScript libraries, including Underscore.js, Swiper, Smartsupp, and Slick, which are consistent with the infrastructure of the legitimate Chain-Rise.org but used here for deceptive purposes. The SSL certificate is issued by Let's Encrypt, providing a false sense of security to potential victims. The domain is currently inactive, having been taken down following detection. Organizations and individuals are advised to block the domain chain-rise.ltd and its associated IP 163.61.188.9 at the network perimeter. Security teams should review logs for connections to this domain or IP, particularly those originating from internal hosts. End-users should be educated on recognizing phishing attempts, especially those impersonating cryptocurrency platforms, and encouraged to verify domain authenticity before entering credentials or sensitive information. Monitoring for similar domains registered through Dynadot Inc or resolving to the same IP range may help preempt future threats.