s1[.]kntn[.]ly

The domain s1.kntn.ly is currently active and resolves to the IP address 64.226.120.197. DNS resolution is provided by three DigitalOcean nameservers (ns1.digitalocean.com, ns2.digitalocean.com, ns3.digitalocean.com), indicating that the hosting environment is a standard DigitalOcean virtual server. HTTP requests to the domain receive a 301 permanent redirect response, but the target of the redirect has not been disclosed in the available data. The page title returned by the web server is “URL Shortener - Free Tool by Kontentino,” which suggests that the domain is being used to masquerade as a legitimate URL‑shortening service associated with the Kontentino brand. No additional content analysis is available, and the visual or functional characteristics of the site have not been examined.

VirusTotal has processed the domain with 91 scanning engines, and none reported a detection. While the lack of detections is a factual observation, it does not constitute evidence of benign intent, especially given the domain’s classification as a generic phishing vector. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the suspicion of malicious use. Registration details indicate the domain was registered through the Libyan Spider Network (int), a registrar that has been linked to other malicious campaigns, adding further context to the risk profile.

Defenders should treat s1.kntn.ly as a potential phishing conduit. Immediate actions include adding the domain to internal blocklists, monitoring outbound DNS queries for the associated IP, and configuring web filtering solutions to block HTTP redirects from this host. Because the redirect target is unknown, threat hunters should capture network traffic to identify any subsequent malicious payloads or credential‑harvesting pages.