shrtlink[.]net

shrtlink.net is flagged as a brand‑impersonation site targeting Google. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the IPv4 address 91.240.21.9, which is attributed to the AS59939 WIBO Baltic UAB network in Germany. No SSL certificate is presented for the host, indicating that HTTPS is not available. The authoritative name servers are ns1.eggywall.cc and ns2.eggywall.cc, both of which are associated with the same hosting infrastructure. The page title returned from the site, “URL Shortener”, does not directly reference the impersonated brand, but the intelligence classification lists Google as the target of the impersonation.

Detection data show that 16 of 93 security vendors on VirusTotal have flagged the domain as malicious, and the domain appears on a single blocklist used by PhishDestroy. AlienVault OTX contains one pulse referencing this indicator, confirming that the domain has been observed in threat‑sharing communities. Gridinsoft assigns a trust score of 1 out of 100, reflecting extreme distrust. The domain is currently offline, which limits active probing but does not remove the historical risk.

Analysts can confirm the malicious nature of shrtlink.net based on the convergence of multiple independent sources: IP reputation, low trust score, vendor detections, blocklist inclusion, and the explicit brand‑impersonation label. Uncertainty remains around the exact payload or phishing page content because the site is no longer reachable and no SSL handshake was captured. Defenders should continue to block traffic to 91.240.21.9 and to the domain itself at the DNS layer, ensure that URL filtering rules flag any attempt to access the domain, and monitor for any re‑appearance of the same name servers or IP range in future campaigns. Ongoing watch‑listing of the registrar NiceNIC International Group Co., Limited is also advisable, given its use in recent malicious registrations.