chainappnetwork[.]netlify[.]app

On July 22, 2026 the domain chainappnetwork.netlify.app was observed as an offline site that had been used for a brand‑impersonation campaign delivering a fake airdrop. The site was hosted on Netlify, as indicated by the detected Netlify technology stack and the presence of HSTS headers. DNS resolution points to the IP address 35.157.26.135, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. The domain was registered on November 21, 2025 through Netlify’s provisioning service and uses the NSONE name servers dns1.p04.nsone.net and dns2.p04.nsone.net. The TLS certificate presented is a DigiCert Global G2 TLS RSA SHA256 2020 CA1 issued by DigiCert Inc., confirming the use of a valid certificate despite the malicious intent.

Security telemetry shows the domain appears on four blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—and has been flagged by 2 of 95 VirusTotal scanners. Both Scamadviser and Gridinsoft assign trust scores of 1/100 and 0/100, respectively, reinforcing the low credibility assessment. An HTTP request returns a 404 status, indicating that the original phishing page is no longer reachable, yet the page title captured earlier was “connect wallet,” consistent with the fake‑airdrop lure. Analysis confirms that the campaign targets multiple brands (“across”) and attempts to harvest cryptocurrency wallet credentials via the “connect wallet” prompt.

The exact content of the page, visual cues, and any embedded malicious scripts have not been captured, leaving those aspects uncertain. Defenders should continue to block the domain at network and endpoint layers, monitor for any resurgence of the URL, and add the associated IP address and name servers to deny lists. Ongoing observation of Netlify‑hosted assets for similar patterns is recommended, as the infrastructure can be rapidly re‑provisioned.