shorta[.]vip

PhishDestroy has identified shorta.vip as an elevated-risk credential theft domain, designed to trick users into revealing their login credentials through a convincing but fraudulent login interface. This generic phishing campaign poses a significant threat to unsuspecting visitors who may mistake the site for a legitimate service.

The domain was created on May 13, 2026, and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 172.67.155.40 and uses an SSL certificate issued by Google Trust Services (WE1). VirusTotal analysis shows 14 out of 95 security vendors flagging the domain as malicious. Additionally, shorta.vip appears in 2 threat intelligence pulses on AlienVault OTX and is listed on 1 security blocklist. The domain is currently offline, which limits immediate risk but does not eliminate the possibility of reactivation.

To protect against credential theft, users should never enter passwords or sensitive information on untrusted sites. Always verify the URL before logging in, enable two-factor authentication where possible, and use a password manager to detect lookalike domains. If credentials were entered on shorta.vip, change passwords immediately and monitor accounts for suspicious activity.