url-link[.]cc

Analysis of the domain url-link.cc indicates it was actively involved in phishing operations as of July 2026. The domain, registered on March 6, 2026, through NiceNIC International Group Co., Limited, presented itself as a URL shortener service, as evidenced by its page title 'URL Shortener.' This aligns with common phishing tactics where legitimate-looking services are used to obfuscate malicious links. The domain resolved to the IP address 151.247.193.142, hosted under AS399486 (12651980 CANADA INC.), with geolocation data pointing to France. Infrastructure analysis reveals the domain utilized nameservers ns1.eggywall.cc and ns2.eggywall.cc, which may suggest a broader malicious infrastructure or shared hosting environment among threat actors.

Detection data from July 24, 2026, shows that 13 out of 95 security vendors on VirusTotal flagged url-link.cc as malicious, a detection rate consistent with confirmed phishing domains. Additionally, the domain appeared on one security blocklist and was blocked by PhishDestroy, further corroborating its classification as a phishing threat. Notably, the domain lacked an SSL certificate, a red flag for user security and a common characteristic of low-effort phishing sites. At the time of reporting, url-link.cc was offline, though its prior activity and detection history warrant continued monitoring.

Defenders should treat this domain as a confirmed phishing vector, particularly given its use of URL shortening as a social engineering tactic. Network-level blocks at the IP and domain level are recommended, along with monitoring for any re-registration or DNS changes. While the exact target or brand impersonated by this campaign remains unconfirmed due to limited page content analysis, the infrastructure and detection patterns strongly suggest its use in distributing phishing links. Further investigation into the nameserver infrastructure (eggywall.cc) may uncover additional related threats.