Gmail URL Shortener Redirect Chain to Credential Harvest Page (chongdaotang.net)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects HTTP traffic involving redirect chains from known Gmail URL shorteners (goo.gl, g.co, short.gy) that terminate at the identified credential-harvesting domain chongdaotang.net. This behavior is indicative of a phishing campaign designed to harvest user credentials through a multi-stage redirect.