dautn[.]link

PhishDestroy identifies dautn.link as an active credential theft domain engaged in generic phishing operations. As of the latest scan, this domain remains unflagged by VirusTotal with 0 detections across 95 industry vendors, despite being blocked by Maltrail’s security feed. The domain has been active since November 25, 2023, and is currently under investigation with a risk level labeled as under_investigation.

This domain was flagged by 1 of 95 VirusTotal vendors while relying on a Google Trust Services SSL certificate and resolving to IP 172.67.145.43. The domain was registered through NAMECHEAP INC and has appeared on 1 security blocklist managed by Maltrail, a leading network threat detection system. Despite its low detection rate, the domain’s SSL certificate from a trusted issuer may contribute to false legitimacy in phishing campaigns targeting unsuspecting users.

While the current risk status remains under investigation, dautn.link poses a credible threat of credential harvesting due to its unresolved phishing behavior and lack of broad detection. Users are strongly advised to avoid interacting with this domain and report any observed phishing attempts to relevant authorities or security teams. Network defenders should monitor for traffic to IP 172.67.145.43 and block the domain at the perimeter level to prevent potential compromise. System administrators should conduct threat hunting based on the indicators provided while Maltrail continues its evaluation of this domain’s maliciousness.