Legal Threat in Your Inbox: How a Gmail Shortlink Hides a Credential-Harvest Destination

An IRONSCALES analysis documents a high-risk credential-harvesting phishing campaign: an anonymized Gmail sender sent a mass-BCC legal-threat lure containing a short.gy link that redirects to a privacy-protected malicious domain (chongdaotang.net) rated malicious, with authentication (SPF/DKIM/DMARC) passing and IRONSCALES flagging the message at 90% confidence; defenders are advised to resolve shortened URLs to their final destinations and verify unexpected legal contacts before clicking.