link-account[.]us

Analysis of the domain link-account.us indicates it was actively involved in a credential phishing campaign prior to being taken offline. The domain, registered on March 6, 2026, through DYNADOT LLC, resolved to the IP address 212.28.182.48, hosted by Contabo Inc. (AS40021) in the United States. Nameservers were set to ns1.dyna-ns.net and ns2.dyna-ns.net, consistent with the registrar’s infrastructure. At the time of assessment, the domain returned a 502 Bad Gateway HTTP status, suggesting either temporary disruption or takedown efforts.

Security vendors have flagged this domain on three distinct blocklists, including PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing threat. Two of 94 security vendors on VirusTotal detected the domain as malicious, though this limited detection count does not rule out broader risk. The SSL certificate, issued by Let’s Encrypt, provides no inherent trust signal, as it is commonly used by both legitimate and malicious sites. The exact target of the phishing campaign remains unconfirmed, as no specific brand or service was identified in the available data.

The domain’s name, however, suggests an attempt to deceive users into believing it is a legitimate account management portal. Defenders should treat this domain as compromised and block all resolutions at the network level. Given its prior association with credential phishing, monitoring for related domains registered through the same registrar or hosted on the same IP range (212.28.182.0/24) may help identify further threats. The domain’s current offline status reduces immediate risk, but historical logs should be reviewed for any prior interactions with internal systems.