nensenlink[.]com

The domain nensenlink.com was registered on April 19, 2026 through Porkbun LLC and has been active since its creation. Within weeks it appeared on a security blocklist and was tagged by PhishDestroy as a high‑risk credential harvesting site. According to the latest threat data, the domain is classified as a generic phishing operation with a high risk rating. Infrastructure analysis shows the domain uses three Porkbun‑provided name servers – curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, and maceio.ns.porkbun.com – and resolves to the IP address 185.81.115.35, which is hosted in the Netherlands by HZ Hosting Ltd. The web service returns HTTP status code 402 and presents an SSL certificate bound to the IP 0.0.0.0, indicating a mis‑configured or placeholder certificate. VirusTotal has flagged the domain in 7 of 95 scanners, and Gridinsoft assigns a trust score of 0 out of 100. Publicly available samples of the site’s content are not yet disclosed, so the exact phishing lure, targeted brands, or credential‑collection mechanisms remain unknown. No malicious payloads, redirects, or command‑and‑control indicators have been observed in the limited traffic captured so far. The limited detection count (one OTX pulse and a single blocklist entry) suggests the campaign may be in an early stage or using a low‑profile distribution method. Defenders should add nensenlink.com and its resolving IP 185.81.115.35 to outbound and inbound block lists across firewalls, DNS filters, and secure web gateways. Continuous monitoring of DNS queries for the three associated Porkbun name servers can reveal additional domains that share the same infrastructure. Given the invalid certificate and the HTTP 402 response, any user‑initiated TLS connection to the site should be terminated. Security teams should also watch for similar domains registered with the same registrar and consider sharing indicators of compromise with industry ISACs to accelerate detection.