ndrt[.]ink

Analysis of the domain ndrt.ink shows an active malicious infrastructure that meets the criteria for a high‑risk generic phishing operation. The domain resolves to the IPv4 address 159.198.32.222 and was registered on February 5 2026 through Namecheap Inc, using the authoritative name servers dns1.registrar-servers.com and dns2.registrar-servers.com. VirusTotal scans have returned detections from 20 of 91 security vendors, indicating that the domain is already recognized as malicious by multiple AV engines. AlienVault OTX lists the domain in four independent threat‑intel pulses, further corroborating its use in phishing campaigns. The combination of recent registration, active DNS resolution, and multi‑vendor detections suggests a deliberate, ongoing campaign rather than a transient test site. At present, no additional contextual data such as payload samples, targeted brands, or phishing page content has been disclosed, leaving the exact lure and victim profile uncertain. Defenders should block outbound traffic to 159.198.32.222 and implement DNS filtering for ndrt.ink across enterprise resolvers. Security operations teams should monitor for any email or web‑based indicators that reference the domain, and threat‑intel feeds should be updated to include the observed OTX pulses. Continuous re‑evaluation is advised as new artifacts become available.