ref-link-ken3mdi93vet2lk28[.]com

The domain ref-link-ken3mdi93vet2lk28.com was registered on March 30 2026 through Fewmoretaps OU d/b/a Trustname.com. DNS resolution points to the IPv4 address 62.60.226.89, and the domain is served by four authoritative name servers: ares.trustname.com, ns1.anycastdns.cz, ns2.anycastdns.cz, and zeus.trustname.com. The hosting infrastructure is therefore associated with the Trustname.com brand and the Anycast DNS service provider. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy filtering service.

VirusTotal analysis reports that 14 of 91 scanning engines flagged the domain, indicating a consensus of malicious classification among multiple vendors. No additional public reputation scores, Safe Browsing status, or Open Threat Exchange identifiers are provided in the current intelligence set. The available evidence points to a confirmed phishing operation, but the specific target brand, page title, or malicious payload has not been disclosed. Consequently, the exact phishing vector—such as credential harvesting page or malicious download—remains undefined.

Defenders should prioritize adding the domain to inbound and outbound deny lists, enforce DNS sinkholing for the listed name servers, and monitor traffic to the IP address 62.60.226.89 for anomalous connections. Given the recent registration date, the threat actor may be testing new infrastructure, so continuous re‑evaluation of the domain’s status is advised. Organizations using web filtering solutions should ensure the domain is included in their blocklists, and incident response teams should be prepared to investigate any user reports that reference this URL.