olinks[.]ltd

This domain, olinks.ltd, has been confirmed as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. Analysis indicates the infrastructure was specifically engineered to mimic legitimate authentication portals, likely targeting unsuspecting individuals through deceptive email campaigns or malicious redirects. The site employed social engineering tactics to trick users into entering usernames, passwords, and potentially multi-factor authentication codes, which could then be exploited for unauthorized account access or financial fraud. Infrastructure analysis reveals multiple technical indicators supporting this classification. The domain was registered on February 22, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious registrations. It resolved to the IP address 193.233.230.67 and was hosted on an Nginx server with HSTS enabled, a configuration occasionally abused to lend false legitimacy to phishing pages. At the time of assessment, 3 out of 95 security vendors on VirusTotal had flagged olinks.ltd as malicious, while it appeared on two security blocklists, including PhishDestroy and OISD. The domain has since been taken offline, though its prior activity remains a concern for potential victims. Users who visited olinks.ltd or entered credentials on the site should take immediate remedial action. All passwords submitted through the domain must be changed across any accounts where they were reused, prioritizing email, financial, and work-related services. Multi-factor authentication should be enabled or reviewed for all critical accounts, and users are advised to monitor for unauthorized transactions or login attempts. If corporate credentials were exposed, internal security teams should be notified to investigate potential lateral movement or data exfiltration risks. Given the domain's recent creation and offline status, affected individuals should remain vigilant for follow-up phishing attempts or malware distribution linked to the same threat actor.