cantonlink[.]app

PhishDestroy identifies cantonlink.app as an active credential harvesting phishing domain. This domain poses a high risk to users through impersonation of legitimate services to steal login credentials. The threat actor operates a deceptive online portal designed to harvest sensitive authentication data under false pretenses, leveraging spoofed branding and social engineering tactics to deceive victims. This domain exhibits multiple red flags consistent with active phishing infrastructure. Registered through GoDaddy.com, LLC on January 25, 2026, cantonlink.app rapidly deployed with a Let’s Encrypt SSL certificate to appear trustworthy. Hosted at 216.198.79.1, the domain remains undetected across 95 VirusTotal engines (2/95 detections at time of analysis), indicating evasive deployment. This low detection rate increases the likelihood of successful compromise. Analysis indicates this domain is not yet widely listed on major blocklists, allowing it to remain accessible to targeted users during early campaign stages. Users who have visited cantonlink.app or entered credentials on its pages should immediately change passwords used on that site and enable multi-factor authentication wherever possible. Scan devices for malware using updated antivirus tools and review accounts for unauthorized access. Report the domain to your security team and flag any intercepted credentials to prevent further misuse. Exercise heightened caution with newly registered domains, especially those using recent SSL certificates and low detection rates on VirusTotal, as these are common indicators of emerging phishing campaigns.