link-probiv[.]org

Analysis of link-probiv.org indicates an active phishing domain registered on March 30, 2026, through TUCOWS.COM, CO. The domain resolves to the IP address 172.67.140.171, which is associated with Cloudflare infrastructure, as evidenced by its nameservers (braelyn.ns.cloudflare.com and steven.ns.cloudflare.com). This hosting pattern is frequently observed in phishing campaigns due to Cloudflare’s provision of anonymity and protection against takedowns. As of July 22, 2026, the domain remains operational and has been flagged by at least one security blocklist, specifically PhishDestroy, though the exact nature of the phishing content or targeted brand has not been confirmed in available intelligence.

No detections were reported by the 95 vendors that scanned the domain on VirusTotal, though this absence does not confirm safety or malicious intent. The domain’s registration details, including its recent creation and use of a privacy-protected registrar, align with common tactics employed by threat actors to evade detection and prolong operational lifespan. Defenders should treat this domain as suspicious based on its infrastructure and blocklist status, particularly in environments where phishing mitigation is a priority. Further investigation is required to determine the specific phishing kit, targeted brand, or victim demographics.

Organizations are advised to monitor network traffic for connections to 172.67.140.171 or the domain itself, and to implement blocking measures if the domain appears in logs or threat feeds. Given the lack of confirmed malicious activity beyond its blocklist inclusion, defenders may also consider submitting the domain for additional scanning or analysis to gather more conclusive evidence. The domain’s continued activity suggests it may still be in use for phishing operations, warranting ongoing vigilance.