one[.]link

Analysis of the domain one.link indicates active brand impersonation targeting Apple, with high-risk infrastructure and confirmed malicious activity. The domain was registered on February 21, 2026, through Dynadot LLC and currently resolves to IP 54.215.31.113, hosted on Amazon.com, Inc. (AS16509) in the United States. Infrastructure analysis reveals the use of nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, alongside technologies such as Highcharts, Bootstrap, jQuery, HSTS, Google Analytics, and Cloudflare, which are consistent with phishing operations. The domain is flagged by 15 of 93 security vendors and appears on two security blocklists, including PhishDestroy and PhishingDB. A 302 HTTP redirect is present, a common tactic to obscure malicious endpoints. The SSL certificate is issued by Let’s Encrypt, a frequently abused provider for phishing campaigns. Known intelligence confirms the presence of a 'Token Presale' phishing kit, though the exact content of the site remains unanalyzed. AlienVault OTX records the domain in 18 threat intelligence pulses, further corroborating its malicious classification. Despite the page title displaying 'For Sale Domain: one.link,' this is likely a deceptive front, as the domain remains actively linked to phishing infrastructure. Defenders should treat this domain as a confirmed threat, block resolution at the DNS level, and monitor for related indicators of compromise. The combination of brand impersonation, phishing kit deployment, and security vendor detections leaves no ambiguity regarding its intent.