ahuliqq[.]onelink[.]me

ahuliqq.onelink.me is a domain flagged for brand impersonation and is currently under investigation. The domain was registered through GoDaddy.com, LLC on February 21, 2026, and is currently active. Infrastructure analysis reveals that the domain resolves to the IP address 172.67.48.125, which is located in the United States and associated with AS52925 Ascenty Data Centers e Telecomunicações S/A. The nameservers for the domain are ns-2026.awsdns-61.co.uk, ns-1241.awsdns-27.org, ns-778.awsdns-33.net, and ns-1241.awsdns-27.org, indicating the use of Amazon Web Services for DNS management. The domain is blocked by PhishDestroy and appears on one security blocklist, suggesting it has been identified as a potential threat by at least one security service. The page title for the domain is 'CS.MONEY — Trading Bot for fast CS:GO/CS2 skins trade,' which aligns with the domain being categorized as a steam_phish, specifically targeting users of the CS:GO and CS2 gaming platforms. The SSL certificate for the domain is rated E1, which is a low assurance level and may indicate a lack of proper security measures. The HTTP status of the domain is 403, which could suggest that the site is intentionally blocking access to certain users or is in a state of maintenance. Gridinsoft's trust score for the domain is 0/100, indicating a very high risk of malicious activity. While the domain has not been flagged by VirusTotal, this does not necessarily imply safety, as detection rates can vary and evolve over time. Defenders should remain vigilant and consider the domain a potential threat, especially given its engagement in brand impersonation and the specific targeting of gaming communities. Further investigation and monitoring are recommended to determine the full scope of the threat and any additional malicious activities associated with the domain.