lob[.]st

This domain, lob.st, is actively involved in credential harvesting phishing campaigns targeting users through deceptive short-link redirection. The site mimics legitimate URL shortening services to trick visitors into entering sensitive login credentials, financial details, or personal information on fraudulent pages. Such attacks often employ social engineering tactics, including fake login portals for banking, email, or corporate services, to capture and exfiltrate user data for unauthorized access or financial fraud. Analysis indicates lob.st was registered on May 20, 2026, through ST Registry, an uncommon registrar for short-link domains. As of the latest scan, 16 out of 95 security vendors on VirusTotal have flagged the domain as malicious, with detections including phishing, fraud, and credential theft. The domain resolves to the IP address 52.2.56.64, hosted on AWS EC2 infrastructure in the us-east-1 region. The SSL certificate, issued by Let's Encrypt (serial number E7), provides HTTPS encryption, which attackers commonly use to lend false legitimacy to malicious sites. The domain appears on at least one security blocklist and remains actively accessible. If you or a user within your network has visited lob.st or interacted with any links originating from this domain, immediate action is required. First, terminate any active sessions on devices used to access the site and disconnect them from the network to prevent potential lateral movement. Reset all credentials entered on or transmitted through the domain, prioritizing email, financial, and administrative accounts. Scan the affected device using updated endpoint protection tools to detect and remove any downloaded payloads or persistent threats. Monitor network traffic for connections to 52.2.56.64 or related subdomains, and review logs for signs of data exfiltration or unauthorized access. Report the incident to your security team for further analysis and containment.