018f3b18cc2962586[.]temporary[.]link

The domain 018f3b18cc2962586.temporary.link is currently active and has been identified as a generic phishing infrastructure. VirusTotal records show that 10 out of 95 scanned security vendors flagged the domain as malicious. The site is indexed on public blocklists PhishDestroy and PhishingDB, indicating that it is already recognized by community‑driven defenses.

Technical resolution points to the IPv4 address 199.250.218.33, which belongs to AS54641 operated by InMotion Hosting, Inc. The IP is geolocated to the United States. The domain was created on 1 March 2019 and is registered through Tucows Domains Inc. Nameservers listed are ns1.inmotionhosting.com, ns2.inmotionhosting.com, ns1.servconfig.com, and ns2.servconfi, all of which resolve to the same hosting provider. An SSL certificate issued by Sectigo Limited (Sectigo Public Server Authentication CA DV R36) is present, and HTTP requests return a 200 status code. Reputation services assign extremely low scores: Gridinsoft reports 0/100 and Scamadviser 1/100, reflecting a high likelihood of abuse.

The page title returned by the web server is “InMotion Hosting”, which matches the legitimate hosting provider rather than a targeted brand, and no additional content has been captured for further analysis. Consequently, while the infrastructure clearly aligns with known phishing operations, the specific victim lures or credential‑harvesting mechanisms remain unverified. Defenders should prioritize immediate containment by adding 018f3b18cc2962586.temporary.link to DNS and URL filtering policies, enforce outbound traffic monitoring to the associated IP address, and consider sinkholing the host if feasible. Ongoing telemetry collection is recommended to detect any future payloads or redirects that may emerge from this domain.