direktlink[.]icu

The domain direktlink.icu was registered on April 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Within days of registration it appeared on a security blocklist and was flagged by PhishDestroy. The site currently returns HTTP 403 and the page title is “Just a moment…”, suggesting that the front‑end is deliberately obscured, a common technique used to evade automated crawlers. Infrastructure analysis shows the domain is hosted behind Cloudflare’s network, resolving to IP 188.114.97.3 located in Canada. Both authoritative name servers, fish.ns.cloudflare.com and zac.ns.cloudflare.com, are Cloudflare‑provided, indicating the operator is leveraging the provider’s DDoS‑mitigation and anonymity capabilities. The TLS certificate is issued by Let’s Encrypt (entity “E8”), confirming the use of a freely‑issued certificate without additional validation. Threat intelligence corroborates a phishing motive. Seven of ninety‑five antivirus and URL‑reputation engines on VirusTotal have flagged the domain, and one AlienVault OTX pulse references it as a malicious indicator. Gridinsoft’s trust score is 0/100, reinforcing the low reputation. The combination of a newly created domain, a blocked‑by‑phishing‑filter status, and the use of generic page content aligns with the generic_phishing classification. Defenders should immediately block traffic to direktlink.icu at perimeter and DNS layers, and add the associated IP 188.114.97.3 to any outbound filtering rules. Continuous monitoring of Cloudflare‑originated traffic for similar patterns is advised, as the infrastructure can be repurposed for additional campaigns. Incident response teams should treat any credential‑harvesting attempts that reference this domain as compromised and enforce credential reset procedures.