worklinka[.]xyz

The domain worklinka.xyz was registered on July 16, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and remains active as of the report date. DNS resolution points to the IP address 38.180.137.133, which is served by the authoritative name servers ns3.my-ndns.com and ns4.my-ndns.com. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, indicating that at least one trusted anti‑phishing platform has identified it as malicious. VirusTotal scans show that 2 of 91 security vendors have flagged the domain, providing additional corroboration of its suspicious nature. The overall risk assessment is high, reflecting the combination of recent creation, active hosting, and detection by multiple independent sources. While the current intelligence does not include details such as SSL certificate attributes, HTTP response codes, or specific page content, the observable infrastructure—registrar, IP, name servers, blocklist presence, and vendor detections—strongly suggests an operational phishing campaign. Defenders should add worklinka.xyz to local blocklists, monitor DNS queries for the associated IP address, and consider sinkholing or null‑routing traffic to mitigate potential victim exposure. Continuous re‑inspection of VirusTotal and additional reputation services is advised to capture any changes in detection counts or emerging threat intelligence.