layerschain[.]com[.]ng

Analysis of layerschain.com.ng confirms its classification as a phishing domain targeting cryptocurrency users, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, and resolves to IP address 66.147.238.157, hosted on AS23535 (HostRocket.com, Inc.) in the United States. The SSL certificate is classified as R11, a low-assurance domain-validated certificate commonly observed in phishing infrastructure. The page title, 'Layers Chain™ | Home,' suggests an attempt to impersonate a cryptocurrency service, though the exact content and target brand remain unconfirmed due to the site being offline.

Security vendor detections are limited but indicative: two of 93 engines on VirusTotal flagged the domain as malicious. It appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, with a Gridinsoft trust score of 0/100, reinforcing its malicious classification. No evidence of a phishing kit or specific lure (e.g., fake wallet login, token swap, or drainer) is available in the current data. The combination of cryptocurrency-themed branding, low SSL certificate assurance, and blocklist presence aligns with known phishing patterns targeting digital asset holders.

Defenders should treat this domain as confirmed malicious infrastructure. Recommended actions include blocking the domain and IP at perimeter controls, monitoring for related subdomains or newly registered lookalike domains, and alerting users who may have interacted with the site prior to its takedown. Further analysis of historical content or associated wallet addresses may provide additional indicators of compromise.