linktreasury[.]org

The domain linktreasury.org is classified as a high‑risk, active generic phishing site as of July 24, 2026. It first appeared on a security blocklist on the same day it was created (February 21, 2026) and is also listed by PhishDestroy. VirusTotal reports that 2 of 93 security vendors have flagged the domain, indicating partial detection. Gridinsoft assigns it a trust score of 0 out of 100, reinforcing the malicious assessment. The site returns an HTTP 307 status, suggesting a temporary redirect that may be used to funnel victims to a credential‑harvesting endpoint.

Technical fingerprinting reveals the presence of Salesforce, Zendesk, Twitter Ads, LinkedIn Insight Tag, jsDelivr, jQuery, HubSpot Chat, and HubSpot Analytics, all of which are commonly abused for tracking and data exfiltration. The domain is registered through NiceNIC International Group Co., Limited and resolves to IP 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Nameservers are anderson.ns.cloudflare.com and dorthy.ns.cloudflare.com, confirming Cloudflare’s DNS hosting. SSL is provided by Google Trust Services under the WE1 certificate, indicating a valid TLS certificate despite the underlying malicious intent.

The only visible page element is the title "Chainlink: The Industry‑Standard Oracle Platform," which does not match the domain name and may be intended to lure users interested in blockchain services. No further page content has been examined, so the exact phishing flow, credential‑capture mechanisms, or payload delivery remain unknown. Defenders should immediately block the domain at perimeter and endpoint controls, add it to internal threat feeds, monitor for any redirects originating from the 307 response, and watch for traffic to the associated Cloudflare IP. Continuous re‑scanning with VirusTotal and other sandbox services is advised to capture any evolving malicious components.