tinyurl-redirect[.]xyz

This domain is flagged for elevated-risk phishing activity targeting users through fake URL shortener services. Analysis indicates the infrastructure is designed to harvest credentials by redirecting victims to fraudulent login portals mimicking legitimate platforms. The threat type is classified as generic_phishing with a focus on credential theft, likely leveraging social engineering tactics to deceive users into entering sensitive information. Infrastructure analysis reveals the domain tinyurl-redirect.xyz was created on June 17, 2026, and resolves to the IP address 104.21.61.22. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain is flagged by 6 out of 95 security vendors on VirusTotal, appears on three security blocklists, and is actively blocked by multiple threat intelligence feeds. Its current status is offline, though historical activity suggests prior malicious use. Mitigation steps for this threat type include implementing DNS-based blocking of the domain and its associated IP address (104.21.61.22) across enterprise and consumer security tools. Organizations should monitor for indicators of compromise, such as unexpected redirects or unauthorized login attempts, and educate users on recognizing phishing tactics involving URL shorteners. Network-level filtering of newly registered domains from high-risk registrars like NICENIC INTERNATIONAL GROUP CO., LIMITED can reduce exposure to similar threats. If credentials were entered on this domain, immediate password resets and multi-factor authentication enforcement are recommended.