csmnmn[.]onelink[.]me

Analysis of csmnmn.onelink.me indicates a generic phishing domain currently active and under investigation. The domain was registered on February 21, 2026, through GANDI SAS and resolves to IP 104.120.210.146, hosted on AS20940 (Akamai International B.V.) in the US. Infrastructure review shows the domain uses AWS nameservers (NS-778.AWSDNS-33.NET, NS-49.AWSDNS-06.COM, NS-2026.AWSDNS-61.CO.UK, and one additional nameserver). The SSL certificate is issued by DigiCert TLS RSA SHA256 2020 CA1, a common certificate authority that does not inherently indicate malicious activity but is frequently used in phishing infrastructure. The domain is flagged on one security blocklist (PhishDestroy) and returns an HTTP 403 status, suggesting access restrictions or server-side blocking of direct requests. No detections were reported by the 93 vendors that scanned the domain on VirusTotal, though this absence does not confirm safety. Gridinsoft assigns a trust score of 0/100, reflecting high suspicion based on other indicators. The domain name structure (csmnmn.onelink.me) suggests an attempt to mimic legitimate deep-linking or app referral services, though the specific brand or service being impersonated remains unconfirmed. No page title, phishing kit, or targeted brand is currently identified in available data. Defenders should treat this domain as high-risk for credential harvesting or malicious redirects, particularly in mobile or app-based contexts. Recommended actions include blocking the domain at DNS or proxy level, monitoring for connections to the associated IP (104.120.210.146), and investigating any user reports of unexpected redirects or app installation prompts linked to this domain.