url.emailprotection.link

Classification: Malicious

url.emailprotection.link is a malicious hostname. Linked to Emotet malware. 541 sightings from 6 threat sources (Phishing), last seen 2026-10-18.

Current activity

  • Offline — no longer resolving. Last online 2026-10-18 06:17:51.
  • Phishing — Hosts a phishing site and is intrinsically malicious.
  • Stores phishing content — Phishing resources are hosted here.

MITRE ATT&CK associations

Malware families: EMOTET (S0367)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Phishing Phishtank 2022-04-11 02:23:33 2026-10-18 06:15:36 compromised malicious-activity phishing
Suspicious URL Triage 2026-09-09 14:57:52 2026-09-09 14:57:52 anomalous-activity
Phishing OpenPhish 2024-09-28 00:33:21 2026-01-19 01:01:43 compromised malicious-activity T1566 Phishing
Top Popularity Site Cisco Umbrella 2022-07-23 02:06:25 2025-10-30 06:53:29 benign
Phishing Internal Revenue Service Phishtank 2025-10-03 10:40:51 2025-10-03 12:32:09 compromised malicious-activity
Top 1M Site Cisco Umbrella 2022-07-18 22:06:01 2025-05-24 10:15:03 benign
Malware Hybrid-Analysis 2021-07-24 10:45:29 2022-01-03 20:30:14
Phishing site Hybrid-Analysis 2021-11-29 19:45:23 2021-12-02 22:00:17
Malicious site Hybrid-Analysis 2020-04-06 20:00:10 2021-11-26 14:45:18
Generic.Malware Hybrid-Analysis 2018-09-19 19:15:14 2021-04-16 08:15:06
Malware site Hybrid-Analysis 2020-11-12 14:00:20 2020-11-12 14:00:20
Emotet Abuse.ch 2018-12-10 19:46:25 2019-04-04 06:26:58 S0367 Emotet
Malware Download Abuse.ch 2018-12-21 06:25:26 2019-01-24 06:03:06
Apple ID phishing Antiphishing.com.ar 2018-11-29 07:54:23 2018-11-29 07:54:23
Phishing PayPal Phishtank 2018-10-30 09:08:48 2018-10-30 09:08:48

Tags

phishing emotet doc docusign discovery

IP addresses resolved by this hostname

Whois information

AS name
AS16406 Intermedia.net, Inc.
Domain
emailprotection.link
TLD
link
DNSSEC
['unsigned']
Nameservers
ns2.serverdata.net, ns3.serverdata.net, ns4.serverdata.net, ns5.serverdata.net
Registrant
1API GmbH
Address
REDACTED FOR PRIVACY
City
REDACTED FOR PRIVACY
State
Arizona
Country
US — United States 🇺🇸
Contact email
[email protected], [email protected]
Domain created
2017-07-13 10:17:20
Domain expires
2029-07-13 10:17:20
First indexed
2018-09-19 19:15:14
Last updated
2026-10-18 06:17:51