# PhishDestroy threat dossier — referral-link-kg15dwi2link24.org ================================================================ Fetched: 2026-07-22 15:39:36 UTC Canonical: https://phishdestroy.io/domain/referral-link-kg15dwi2link24.org/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 85/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 4/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, ESET, Fortinet, Netcraft URLQuery: 2 detections Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 62.60.226.89 (DE, Frankfurt am Main) ASN: AS214351 FEMO IT SOLUTIONS LIMITED Hosting org: Femo IT Solutions Limited Registrar: TUCOWS.COM, CO. Nameservers: 1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo Registered: 2026-02-22 Expires: 2027-02-22 Page title: Home | Swap HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YE2 Expires: 2026-09-20 Status: INVALID chain Fingerprint: 2bbd36519b4357f00ae5b39686b9071f33b1d10d8871d990c64369cdf5087dee ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-02-22 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-20 15:10:27 UTC (by PhishDestroy tracker) First reported: 2026-07-20 13:13:06 UTC (abuse notice filed) Last verified: 2026-07-22 16:20:22 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f7fa4-da37-7045-b0f1-ed1b06fc4540/ URLQuery: https://urlquery.net/report/bb106576-749c-4726-a973-00675b4d3c90 Wayback Machine: https://web.archive.org/web/*/referral-link-kg15dwi2link24.org crt.sh CT logs: https://crt.sh/?q=%25.referral-link-kg15dwi2link24.org Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=referral-link-kg15dwi2link24.org AlienVault OTX: https://otx.alienvault.com/indicator/domain/referral-link-kg15dwi2link24.org URLhaus: https://urlhaus.abuse.ch/host/referral-link-kg15dwi2link24.org/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-20 15:11:20 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] referral-link-kg15dwi2link24.org Safety Check — Generic Phishing Analysis of referral-link-kg15dwi2link24.org indicates that the domain is actively used for a generic phishing campaign. VirusTotal records show three of ninety‑five scanned security vendors flagged the domain as malicious, providing independent confirmation of its malicious intent. DNS resolution points to the IPv4 address 62.60.226.89, and the domain is listed on a public blocklist, reinforcing the likelihood of abusive activity. The domain is registered through TUCOWS.COM in the Commonwealth of the Northern Mariana Islands, with a creation timestamp of 22 Feb 2026, suggesting a relatively recent deployment. Nameserver configuration includes three NJALLA‑operated servers (1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo), a pattern frequently observed in fast‑flux or disposable hosting used by threat actors. PhishDestroy has already added the domain to its blocklist, indicating that at least one industry‑focused mitigation service considers it high‑risk. The domain’s current status is listed as active, meaning it continues to resolve and potentially serve malicious content. No publicly available data on SSL certificates, HTTP response codes, Safe Browsing status, OTX mentions, page titles, or brand targeting has been observed, leaving those aspects of the infrastructure unverified. Defenders should proactively block referral-link-kg15dwi2link24.org at perimeter firewalls, DNS resolvers, and proxy filters, and consider adding its hosting IP 62.60.226.89 to network‑level deny lists. Continuous monitoring of traffic to the identified nameservers and IP address is advised to detect any pivot or re‑use of the infrastructure. Given the limited but concrete evidence of malicious use, the domain should be treated as high‑risk until additional contextual data, such as payload samples or sinkhole observations, can be obtained. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260720-FE8BF0 Favicon MD5: a894fe0ef912501e81a662610fbc8ca9 TLS cert SHA-256: 2bbd36519b4357f00ae5b39686b9071f33b1d10d8871d990c64369cdf5087dee ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/referral-link-kg15dwi2link24.org/ JSON API: https://api.destroy.tools/v1/check?domain=referral-link-kg15dwi2link24.org Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,196 domains (57,641 alive under monitoring, 128,922 confirmed takedowns/dead). Site: https://phishdestroy.io