Shorten URL domain is.gd is phishing? [undetected by avast]

system · 2015-05-16T13:43:41.000Z

https://www.c-sirt.org/en/incidents-on-domain/is.gd show that the domain contain a lot of phish content but is not blocked by avast.
Identified by Dr. web as known infection source: https://www.virustotal.com/en/url/8bce79b26840bb98ec4302fcaa29790ea311f0702d0bed487eac2200e6c5471f/analysis/
sucuri site check also say something about phishing: https://sitecheck.sucuri.net/results/is.gd
Blacklisted by quttera: http://quttera.com/detailed_report/is.gd

polonus · 2015-05-16T14:02:40.000Z

Hi rickyyeung,

Thanks for alerting us to it.
Some links have already been closed down, see: http://urlquery.net/report.php?id=1431784026414
There certainly was malware there: http://urlquery.net/report.php?id=1431665925407
This site named after the mystical ninja is flagged by Avast as unsafe to visit & WOT flags it:
https://www.mywot.com/en/scorecard/gomen.ninja?utm_source=addon&utm_content=popup
Condoned: domain is NOT BANNED from Google Adsense program!

<script type="text/javascript"> 
window.top.location.href="htxp://wXw.weightloss-secrets-revealed.net/goren/";

</script>

Two warnings: https://asafaweb.com/Scan?Url=wXw.weightloss-secrets-revealed.net%2Fgoren
SEO Spam redirects -
Visitors from search engines are redirected
to: htxps://s3.amazonaws.com/f3bj140ghjf21nh19/index.html
3 sites infected with redirects to this URL Amazon Web Services isn’t inherently bad… It’s just that a bunch of shady people use it for their own shady purposes. Marked for PHISHING - and adult cloud data content -

They are disabling links now due to violations of terms and conditions, see: http://urlquery.net/report.php?id=1431785125272

Also this malware found: -t.dtscout dot com/i/?l=http%3A%2F%2Fsocialvideosx.attorney%2Fcvideo%2Findex.html%3Fugurlu2222
Re: https://www.virustotal.com/nl/domain/t.dtscout.com/information/

polonus

Pondus · 2015-05-16T14:45:24.000Z

Short URL
https://www.virustotal.com/en/url/8bce79b26840bb98ec4302fcaa29790ea311f0702d0bed487eac2200e6c5471f/analysis/

Long URL
https://www.virustotal.com/en/url/8a8e99cf574fc1c9a573691d3e5fd3440b524d200e2106e6d0b58bf7d4f8d845/analysis/1431787258/

and file
https://www.virustotal.com/en/file/373f74a9ed59d0ee5178cadc7abc57a86c85baa313c8783e65c2cd5f79714567/analysis/1431787553/

polonus · 2015-05-16T15:05:51.000Z

htxp://is.gd links to the following External Domains:
==>createform.js
==>isgdlogo.jpg Re: http://necolib-cooltools.wikispaces.com/url+shortening

polonus

Announcements