farm-chainlink[.]com

This domain, farm-chainlink.com, is identified as a fake cryptocurrency staking portal designed to deceive users into connecting wallets to malicious smart contracts. Analysis indicates the site impersonates legitimate Chainlink staking services, luring victims with fraudulent yield offers. The domain is currently offline, but prior activity suggests it operated as a crypto drainer, siphoning funds from compromised wallets. Infrastructure analysis reveals the domain was registered on April 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolved to the IP address 172.67.138.128, a Cloudflare proxy endpoint commonly used to obscure hosting origins. VirusTotal reports that 1 of 95 security vendors flagged the domain as malicious, a low but notable detection rate given the domain's recent creation. The SSL certificate was issued by Let's Encrypt, a free and automated certificate authority often exploited by threat actors to lend a false sense of legitimacy. No additional blocklist entries or trust scores were recorded at the time of assessment. The domain has since been taken offline, likely due to enforcement action or abandonment by the operators. However, the infrastructure remains a potential risk, as domains of this nature are often reactivated or repurposed. Users are advised to verify the authenticity of any Chainlink-related staking portal by cross-referencing official communications from the Chainlink project. Wallet providers and security teams should monitor for connections to 172.67.138.128 and the domain itself in logs, as these may indicate attempted interactions with the fraudulent service. Proactive blocking of the domain and associated IP at the network level is recommended to prevent future exposure.