jdkske[.]onelink[.]me

Analysis of jdkske.onelink.me shows a newly registered domain (creation date 21 February 2026) that is currently active and listed on a single security blocklist. The domain resolves to IP address 23.199.55.37, which is advertised as part of AS20940 operated by Akamai International B.V. in the United States. DNS is served by four Amazon Route 53 name servers (ns-2026.awsdns-61.co.uk, ns-1241.awsdns-27.org, ns-778.awsdns-33.net, and a fourth entry truncated in the source). The site presents an HTTP 403 response, indicating that direct content retrieval is blocked, a behavior often used to hide malicious payloads behind redirects or client‑side scripts. The SSL certificate presented is a DigiCert TLS RSA SHA256 2020 CA1 certificate, which is valid but provides no indication of legitimate ownership. Reputation scoring from Gridinsoft assigns a trust score of 0/100, and the domain has been blocked by PhishDestroy, reinforcing its classification as a generic phishing infrastructure. Registration was performed through GoDaddy.com, LLC, a common registrar for malicious actors. No public malware detections are recorded on VirusTotal, but the absence of detections does not mitigate the observed risk. Given the combination of recent registration, low trust score, blocklist presence, and the 403 response, defenders should treat jdkske.onelink.me as a high‑confidence phishing indicator. Recommended actions include adding the domain to outbound and inbound blocklists, monitoring DNS queries for the associated IP address, and employing threat‑intel feeds that reference the listed name servers and ASN for broader correlation.