chainlurk[.]com

chainlurk.com was registered through NiceNIC International Group Co., Limited on 21 February 2026. The domain resolves to the Cloudflare network (IP 104.21.76.252, AS13335, United States) and uses Cloudflare’s DNS (aiden.ns.cloudflare.com and blakely.ns.cloudflare.com). The presented SSL certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS handshake. The public page title reads “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | Сhainlurk”, suggesting a cryptocurrency exchange façade that targets the Ethereum brand.

Gridinsoft assigns a trust score of 1 / 100, reflecting extreme suspicion. VirusTotal reports three of ninety‑five security vendors flagging the domain, and PhishDestroy has taken the site offline and placed it on a blocklist; it appears on one additional security blocklist. The domain is currently classified as a crypto scam and brand impersonation of ethereum. Evidence confirms that the infrastructure is hosted on Cloudflare, but no further hosting details are disclosed.

Because the site is offline, active observation is limited; however, the registration timestamp, low trust score, and vendor detections indicate a deliberate malicious campaign. Defenders should immediately block the domain and its associated IP address, add the nameservers to monitoring lists, and update intrusion‑detection signatures to capture similar brand‑impersonation patterns. Ongoing surveillance of newly registered domains using the same registrar or Cloudflare infrastructure is advised, as adversaries often recycle these components for future campaigns.