referral-link-opdl2linkd31[.]org

Referral-link-opdl2linkd31.org is currently active and classified as generic phishing. The domain was registered on 31 May 2026 through Fewmoretaps OU d/b/a Trustname.com and resolves to the IPv4 address 62.60.226.89. DNS resolution is served by four authoritative name servers: ares.trustname.com, ns1.anycastdns.cz, ns2.anycastdns.cz, and zeus.trustname.com. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy feed, indicating that at least one reputable anti‑phishing service has observed malicious activity originating from it.

VirusTotal scans show that 2 of 91 security vendors flagged the domain, reinforcing the suspicion despite the low overall detection rate. No additional public intelligence such as SSL certificate details, HTTP response codes, or page titles is presently available, so the exact content and attack vector remain unverified. The limited detection footprint—one blocklist entry and two vendor flags—suggests the campaign may be in an early deployment phase or employing evasive techniques to avoid broader detection.

Defenders should proactively block referral-link-opdl2linkd31.org at network perimeter and endpoint filters, monitor DNS queries for the listed name servers, and consider adding the IP address 62.60.226.89 to reputation‑based deny lists. Continuous re‑evaluation of VirusTotal and other sandbox feeds is recommended, as additional detections could emerge if the site becomes more widely used. Organizations that rely on email or web gateway controls should enforce strict URL filtering for newly observed phishing domains, especially those associated with the Trustname.com registrar, to mitigate potential credential harvesting attempts.