chainlinkjob[.]tech

This domain, chainlinkjob.tech, is actively engaged in crypto credential theft, targeting users through fraudulent job recruitment schemes associated with blockchain employment opportunities. Analysis indicates the domain impersonates legitimate platforms to harvest wallet credentials, likely deploying a credential-harvesting kit designed to exfiltrate sensitive information such as private keys or seed phrases. No direct evidence of a crypto drainer script was observed, but the infrastructure aligns with known credential theft campaigns targeting decentralized finance (DeFi) users. Infrastructure analysis reveals the domain was registered on June 15, 2026, through Infomaniak Network SA, a registrar frequently exploited for malicious operations. It resolves to the IP address 128.65.195.180, which has been associated with prior phishing activity. The domain is flagged by 4 out of 95 security vendors on VirusTotal, indicating moderate detection but persistent evasion tactics. An SSL certificate issued for 'localhost' suggests minimal effort to appear legitimate, a common trait in low-sophistication phishing campaigns. The domain appears on three security blocklists, including high-confidence feeds, and remains unlisted by Google Safe Browsing (GSB) as of the latest scan. As of the most recent assessment, chainlinkjob.tech remains active and unresolved, continuing to pose a high risk to users. Response actions by security providers, including domain blocking and client-side warnings, have been implemented, but the infrastructure remains accessible. The absence of takedown measures increases the likelihood of continued exploitation. Users are advised to treat any communication or job listings from this domain as malicious. Wallet holders should verify recruitment platforms via official channels and employ hardware-based or multi-signature authentication to mitigate credential theft risks. Organizations are recommended to update blocklists with the domain and IP, monitor for related infrastructure, and educate users on recognizing fraudulent job recruitment tactics in the crypto space.