.US HARBORS PROLIFIC MALICIOUS LINK SHORTENING SERVICE

Summary from the TLDR InfoSec newsletter

Researchers at Infoblox have been tracking a three year old link shortening service that caters to threat actors. Prior to May 2023, the shortening service primarily used .info domains, but it has now migrated to primarily using .US domains. The .US top-level domain (TLD) is meant to be managed and verified by the National Telecommunications and Information Administration, but researchers have speculated that this management has been outsourced, leading to the TLD hosting many phishing websites.