tini[.]fyi

This domain is flagged as a confirmed credential harvesting phishing site leveraging a URL shortening facade to deceive users. Analysis indicates the infrastructure is designed to intercept login credentials, financial details, or personal data through malicious redirects or cloned authentication portals. The elevated risk level stems from its operational intent to exploit trust in URL shorteners, a tactic increasingly used to bypass email and web filtering systems. Infrastructure analysis reveals the following technical indicators: the domain tini.fyi was registered on March 10, 2026, through Spaceship, Inc., and resolves to IP address 165.232.185.25, hosted on AS14061 (DigitalOcean, LLC) in India. The site uses a Let's Encrypt R12 SSL certificate, providing HTTPS encryption to appear legitimate. VirusTotal detection shows 14 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. The page title, 'Tini.fyi - Free, Fast, and Private URL Shortener,' reinforces the deceptive branding, mimicking trusted services to lower user vigilance. Mitigation requires immediate action from network defenders and end users. Organizations should block the domain tini.fyi and its resolving IP 165.232.185.25 at the firewall, DNS, and proxy levels. Security teams are advised to monitor logs for connections to the domain or IP and investigate any associated credential submissions. End users should be trained to scrutinize URL shorteners, especially those not originating from known, reputable providers. If credentials were entered on this site, affected accounts must be secured immediately, including password resets and multi-factor authentication enforcement. Domain registrars and hosting providers should be notified to facilitate takedown procedures under abuse policies.