rkns[.]link

The domain rkns.link is currently identified as an active generic phishing threat, specifically designed to impersonate a content access and audience growth platform. Analysis indicates the domain is likely targeting users with fraudulent login portals to harvest credentials or distribute malicious payloads under the guise of legitimate service offerings. The page title, 'Control Access to Your Content and Grow Your Audience | Rekonise - Rekonise,' suggests an attempt to mimic a professional content management or monetization service, increasing the likelihood of user deception. Infrastructure analysis reveals multiple high-risk indicators. The domain is flagged by 13 of 95 security vendors on VirusTotal, including entries on two security blocklists: PhishDestroy and PhishingDB. It was registered through NAMECHEAP INC on July 13, 2021, and resolves to the IP address 104.21.35.79, hosted on AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services under the identifier WE1, which, while legitimate in origin, is frequently exploited by malicious domains to appear trustworthy. The domain's creation date over two years ago and continued activity suggest a persistent, evolving threat rather than a short-lived campaign. Current status confirms the domain remains active and unresolved, posing an ongoing risk to users. Security teams are advised to block the domain and its resolving IP at the network perimeter. End users should avoid interacting with any content hosted on rkns.link, particularly login prompts or download links. Organizations are recommended to monitor for credential reuse attempts from harvested data and implement multi-factor authentication to mitigate potential account takeovers. The combination of blocklist presence, vendor detections, and infrastructure longevity underscores the need for immediate containment and user awareness.