tolk[.]shorturl[.]lk

Analysis of tolk.shorturl.lk, created on 21 February 2026 and registered through Privatesystems, shows a high‑risk phishing short‑URL service. The site presents the page title "Short URL Generaotor - Free Short Links and Track Link Activites | ShortURL - to" and serves a 302 redirect, indicating that visitors are immediately forwarded to another location. The TLS certificate is issued by Let’s Encrypt (R12), confirming the use of HTTPS but offering no assurance of legitimacy. Infrastructure inspection reveals the domain resolves to 209.42.255.1, an address located in the Netherlands and announced by AS63410 PrivateSystems Networks.

The host runs LiteSpeed web server, leverages SweetAlert2, reCAPTCHA, jsDelivr, Google Analytics, and supports HTTP/3, all typical of legitimate services but also commonly abused in phishing campaigns. DNS is delegated to a broad set of Sri Lankan name servers (d.nic.lk, h.nic.lk, m.nic.lk, ns1.ac.lk, p.nic.lk, t.nic.lk, z.nic.lk), a pattern sometimes used to obscure ownership. Threat intelligence feeds show that 11 of 93 VirusTotal scanners flag the domain, it appears on one public blocklist, and PhishDestroy has actively blocked it. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

While the exact landing page after redirection remains unverified, the combination of recent registration, low trust scoring, multi‑vendor detections, and active blocklist listings warrants immediate mitigation. Defenders should add the IP and domain to deny‑list rules, monitor DNS queries for the listed name servers, and enforce URL‑filtering policies that block redirects from this host. Continuous re‑evaluation is advised as additional evidence may emerge.