shortlink[.]st

The domain shortlink.st is identified as a malicious URL shortening service configured for brand impersonation of Gmail. The infrastructure presents itself as a generic URL shortener while being used to redirect or mask phishing destinations. The risk profile is elevated due to its association with credential harvesting tactics targeting email account users.

Technical evidence indicates the domain was created on November 24, 2025 and registered through IncogNET. Resolution data shows hosting on IP 91.92.242.100 located in the Netherlands under AS202412 Omegatech LTD. Security telemetry reports the domain is flagged by 19/95 VirusTotal vendors and appears on 2 independent security blocklists. TLS configuration uses a Let's Encrypt certificate (E7), consistent with rapidly deployed phishing infrastructure.

At the time of assessment, the domain is taken offline, indicating successful disruption of active malicious use. However, historical indicators confirm prior phishing activity and continued relevance for threat tracking. Users who may have interacted with this domain should assume potential credential exposure and reset affected accounts, particularly email services, while enabling multi-factor authentication. Network defenders should monitor for reuse of the same IP space and certificate patterns, as these are commonly recycled in follow-on campaigns.