referral-link-kt12dit1link22[.]org

Analysis of the domain referral-link-kt12dit1link22.org indicates active involvement in a phishing campaign targeting referral or affiliate link schemes. The domain was registered on February 22, 2026, through TUCOWS.COM, CO., a registrar commonly utilized for both legitimate and malicious registrations. Infrastructure analysis reveals the domain resolves to the IP address 62.60.226.89, with nameservers distributed across Njalla’s infrastructure (1-you.njalla.no, 2-can.njalla.in, and 3-get.njalla.fo), a provider frequently associated with bulletproof hosting services. As of July 20, 2026, the domain remains active and has been flagged by 11 of 95 security vendors on VirusTotal, alongside inclusion on one security blocklist, specifically PhishDestroy. The detection rate suggests moderate but not universal recognition of the threat, which may indicate either a targeted campaign or a recently deployed phishing operation. Defenders should note that the domain’s registration age (approximately five months old at the time of this report) does not align with typical long-term phishing infrastructure, which often cycles domains more rapidly. However, the use of Njalla’s nameservers may provide operational resilience, complicating takedown efforts. The exact content or brand impersonation of the phishing site has not been analyzed, and no specific scam category (e.g., financial, credential harvesting, or crypto-related) is confirmed in the available data. The domain’s structure, incorporating randomized alphanumeric strings, is consistent with automated phishing domain generation, a tactic designed to evade basic pattern-based detection. Organizations are advised to block the domain at the DNS or proxy level, particularly if referral or affiliate link schemes are not part of their legitimate operations. Network defenders should monitor for connections to 62.60.226.89 and correlate logs with other indicators associated with Njalla-hosted infrastructure.