shortsurl[.]bio

The domain shortsurl.bio is identified as a generic phishing resource currently offline but previously active in campaigns impersonating the Roblox gaming platform. Analysis confirms its use in credential harvesting operations, presenting an elevated risk to users who may have interacted with the site under false pretenses of legitimate Roblox services. The page title explicitly references Roblox, reinforcing its association with fraudulent activity targeting the platform’s user base. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered on May 28, 2026, through INWX GmbH, a registrar frequently observed in phishing operations. It resolves to the IP address 179.43.150.242 and is flagged by 22 of 95 security vendors on VirusTotal, while also appearing in two AlienVault OTX threat intelligence pulses. The domain is listed on one security blocklist, and its SSL certificate, issued by Let’s Encrypt (serial number YE2), does not mitigate its fraudulent nature. Detection rates and threat intelligence correlations further substantiate its classification as a high-confidence phishing resource. As of the latest assessment, shortsurl.bio has been taken offline, though residual risk remains for users who may have engaged with the domain prior to its deactivation. Organizations and individuals are advised to block the domain and its associated IP at the network level, revoke any credentials potentially exposed through interaction with the site, and monitor accounts for unauthorized activity. Security teams should treat this domain as a confirmed malicious indicator and incorporate its technical artifacts into threat detection rulesets for proactive defense.