pampams[.]onelink[.]me

The domain pampams.onelink.me was registered on February 21, 2026 through the OneLink (Branch) service. The site presents an Amazon‑issued RSA 2048‑bit certificate (M02) which is typical for services hosted on Amazon infrastructure, but the certificate alone does not guarantee legitimacy. The domain is currently classified as a generic phishing actor and remains under investigation.

Network resolution points the domain to the IPv4 address 18.244.164.36, which resolves to a host in Great Britain owned by AS16509 Amazon.com, Inc. The HTTP response returns a 403 status code, indicating that direct access is denied without further context. Reputation services assign a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist, confirming that external monitoring systems have flagged it.

VirusTotal has recorded 0 detections out of 95 scanners to date, meaning no automated engine has yet flagged the host as malicious. However, the absence of detections does not imply safety, especially given the active blocklist entry and the low trust score. The domain’s activity is listed as active, and it continues to resolve to the same IP address, suggesting that the infrastructure is still operational.

Defenders should add pampams.onelink.me to outbound filtering rules and block any DNS resolution attempts. Monitoring of network traffic for connections to 18.244.164.36 is advised, and any observed HTTP 403 responses should be logged for correlation with potential credential‑stealing attempts. Continuous re‑scanning on VirusTotal and other sandbox services is recommended to detect any future payload changes.