toptut[.]onelink[.]me

The domain toptut.onelink.me was created on 21 February 2026 and is presently listed as active under the generic_phishing classification. It is hosted on Amazon’s cloud infrastructure (ASN 16509) and resolves to the IPv4 address 108.139.47.37 located in the United States. The TLS certificate presented by the server is an Amazon RSA 2048 M02 certificate, indicating the use of standard Amazon‑issued HTTPS.

Registration was performed through the OneLink (Branch) service, a known URL shortening platform that can be abused to conceal malicious destinations. The domain’s Gridinsoft trust score is 0 out of 100, and it currently returns HTTP 403 for direct requests, which may be an attempt to hide content from casual inspection. The hosting IP is part of Amazon’s public address space, a common choice for threat actors seeking scalable and reputable infrastructure.

Threat intelligence feeds have added the domain to a single security blocklist and PhishDestroy has already blocked it. No detections were reported on VirusTotal at the time of analysis (0 / 95 engines), but the absence of detections does not imply safety. The exact payload, landing page content, or credential‑harvesting mechanisms have not been publicly disclosed, leaving the specific phishing vector uncertain.

Defenders should immediately block DNS resolution for toptut.onelink.me and consider adding the associated IP address 108.139.47.37 to network deny lists. Continuous monitoring of traffic to the Amazon ASN 16509 range for anomalous patterns is advised, as is the deployment of URL‑filtering solutions that can flag OneLink‑derived links. Incident response teams should treat any credential submissions linked to this domain as compromised and enforce credential resets where applicable.