chainlink[.]sale

The domain chainlink.sale is a confirmed phishing site engaged in brand impersonation targeting the 'across' cryptocurrency platform. It presents itself as a Chainlink (LINK) airdrop to deceive users into connecting wallets or entering sensitive credentials, posing risks of unauthorized access or asset theft. No drainer kit was identified, but the site employs seed phishing, airdrop scam, and wallet-connect phishing tactics. As of the latest verification, chainlink.sale has been taken offline.

Technical indicators confirm the elevated risk. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Gridinsoft and SOCRadar, with a Gridinsoft trust score of 0/100. It appears on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. Registered through Global Domain Group LLC on February 21, 2026, chainlink.sale resolves to the IP address 104.21.49.153, hosted on Cloudflare's US infrastructure (AS13335). The SSL certificate is issued by WE1, and the observed page title was 'Chainlink (LINK) | Airdrop'. Google Safe Browsing has not flagged the domain.

Users who interacted with chainlink.sale should immediately revoke any token approvals granted to unknown contracts via wallet interfaces like Etherscan or Revoke.cash. Transfer remaining funds to a new, secure wallet and monitor accounts for unauthorized transactions. Change passwords for any accounts accessed through the site and enable two-factor authentication (2FA) where available. Report the domain to relevant platforms, including the impersonated brand 'across', and submit it to threat-sharing communities such as PhishTank or URLVoid to aid in broader mitigation efforts.