referral-link-kg15dwi2link24[.]org

Analysis of referral-link-kg15dwi2link24.org indicates that the domain is actively used for a generic phishing campaign. VirusTotal records show three of ninety‑five scanned security vendors flagged the domain as malicious, providing independent confirmation of its malicious intent. DNS resolution points to the IPv4 address 62.60.226.89, and the domain is listed on a public blocklist, reinforcing the likelihood of abusive activity. The domain is registered through TUCOWS.COM in the Commonwealth of the Northern Mariana Islands, with a creation timestamp of 22 Feb 2026, suggesting a relatively recent deployment. Nameserver configuration includes three NJALLA‑operated servers (1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo), a pattern frequently observed in fast‑flux or disposable hosting used by threat actors. PhishDestroy has already added the domain to its blocklist, indicating that at least one industry‑focused mitigation service considers it high‑risk. The domain’s current status is listed as active, meaning it continues to resolve and potentially serve malicious content. No publicly available data on SSL certificates, HTTP response codes, Safe Browsing status, OTX mentions, page titles, or brand targeting has been observed, leaving those aspects of the infrastructure unverified. Defenders should proactively block referral-link-kg15dwi2link24.org at perimeter firewalls, DNS resolvers, and proxy filters, and consider adding its hosting IP 62.60.226.89 to network‑level deny lists. Continuous monitoring of traffic to the identified nameservers and IP address is advised to detect any pivot or re‑use of the infrastructure. Given the limited but concrete evidence of malicious use, the domain should be treated as high‑risk until additional contextual data, such as payload samples or sinkhole observations, can be obtained.