What Gridinsoft observed on All-z.co
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260826234846-0304a6d1
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Corporate URL Redirector — Exact-Link Review Required
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent current review did not reproduce phishing or malware behavior on all-z.co. The fresh Gridinsoft scan named no harmful object, and all six exact short links surfaced by public indexes currently directed ordinary browser profiles only to official www.allianz.co PDF paths. No exact malicious URL, credential receiver, unrelated destination, executable, payload, or hash was identified behind the domain blacklist categories. The prior broad Phishing result is therefore unsupported and should be replaced by the narrower Suspicious Website classification. A domain-wide Safe conclusion is not warranted because the complete short-code namespace cannot be enumerated and known links hide their destinations from crawler, command-line, reviewer, and some mobile profiles. This result applies to the reviewed root and six known codes; future concerns require exact-link and destination-specific review.
Analyst findings
Review 7 documented observations View evidence
A fresh supported Gridinsoft rescan completed for all-z.co. The root returned HTTP 404, the result exposed no positive behavior signal, and it did not identify an exact credential receiver, unrelated redirect, automatic download, malware file, payload, exploit, command, or hash. The pre-existing Phishing result remained attached to the broad domain signature rather than to a reproduced harmful object.
- Public artifact URL https://gridinsoft.com/online-virus-scanner/url/all_z-co
-
HTTP status
404 - Page element The fresh result contained no positive behavior signal.
- Analyst observation The fresh result did not name a concrete harmful all-z.co URL, destination, file, payload, receiver, command, exploit, or hash.
The apex resolved to two AWS Global Accelerator IPv4 addresses and served an empty HTTP 404 response over HTTPS. The www name did not resolve. The apex certificate covered only all-z.co and was valid from 2026-02-02 through 2027-03-03. A same-length nonexistent short code returned HTTP 404, while robots.txt, sitemap.xml, and favicon.ico returned bounded error text rather than a public directory or link-creation interface.
- DNS fact all-z.co resolved to 3.33.208.53 and 15.197.217.248; www.all-z.co did not resolve.
-
HTTP status
404 - Certificate fact Amazon RSA 2048 M01 certificate for all-z.co, valid 2026-02-02 through 2027-03-03.
- Analyst observation The nonexistent short code /QQ00000 returned HTTP 404 and an explicit not-found response.
Every concrete short code surfaced by public URL intelligence or exact search was checked directly. The six distinct codes redirected ordinary desktop-browser profiles only to six PDF paths on the official www.allianz.co host. One code was also preserved inside an Allianz Colombia insurance document as the link to its general conditions. None of these exact samples redirected to an unrelated host, requested credentials, initiated an executable or archive download, or exposed a malware payload.
-
Redirect destination
https://www.allianz.co/content/dam/onemarketing/iberolatam/allianz-co/seguros/personas/salud/contratos/Salud-Gold-Plus-01072024-Version-01-1.pdf -
Redirect destination
https://www.allianz.co/content/dam/onemarketing/iberolatam/allianz-co/seguros/empresas/documentos/2023/octubre/Negocio-Empresarial-Pyme-18102023-Version-07.pdf -
Redirect destination
https://www.allianz.co/content/dam/onemarketing/iberolatam/allianz-co/seguros/empresas/documentos/Agricola-11102023-V2.pdf -
Redirect destination
https://www.allianz.co/content/dam/onemarketing/iberolatam/allianz-co/seguros/personas/hogar/2021/Hogar-Individual-13122023-Version-24.pdf -
Redirect destination
https://www.allianz.co/content/dam/onemarketing/iberolatam/allianz-co/seguros/empresas/documentos/Manejo-Global-Comercial-y-Estatal-10042024-V4.pdf -
Redirect destination
https://www.allianz.co/content/dam/onemarketing/iberolatam/allianz-co/seguros/empresas/documentos/Multirriesgo-06112024-V8.pdf - Analyst observation The checked codes were /QQACEhJ, /QQzxgNi, /QQzxgMw, /QQzxfZq, /QQzxgQm, and /QQbg5AN.
The redirect service disclosed destinations selectively by user agent. Windows Chrome, Edge, Firefox, macOS Safari, and iPhone Safari profiles received the same HTTP 302 destination for the sampled code. Android Chrome, curl, Googlebot, Bingbot, Facebook preview, and Gridinsoft-review profiles instead received HTTP 200 with the two-byte body OK and no Location header. The same split was reproduced across all six known codes. This conditional destination suppression impedes automated object review, even though the destinations revealed to ordinary browser profiles were official Allianz documents.
-
HTTP status
302 -
Redirect destination
https://www.allianz.co/content/dam/onemarketing/iberolatam/allianz-co/seguros/personas/salud/contratos/Salud-Gold-Plus-01072024-Version-01-1.pdf - Analyst observation Windows and macOS desktop browsers plus iPhone Safari received HTTP 302; Android Chrome, curl, crawler, preview, and reviewer profiles received HTTP 200 with body OK and no Location header.
- File SHA-256 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
Public OSINT for the exact host and its registrable parent referred to the same apex domain. urlscan returned no exact public scan. OTX returned zero pulses and seven URL observations: the root plus six short codes, all of which were checked directly. Wayback returned no snapshot. The current full public ThreatFox export, current URLhaus recent feed, and current OpenPhish feed contained no exact match. Exact public sandbox searches did not surface a sample-level result. Unavailable, authentication-only, and unindexed sources were treated as incomplete rather than clean.
- Public artifact URL https://otx.alienvault.com/indicator/domain/all-z.co
- Public artifact URL https://urlscan.io/domain/all-z.co
- Public artifact URL https://web.archive.org/web/*/all-z.co/*
- Analyst observation OTX returned zero pulses and seven URL observations; urlscan returned zero exact-host results; Wayback returned no record.
- Analyst observation The current full ThreatFox export, URLhaus recent feed, and OpenPhish feed contained no exact all-z.co host or URL match.
- Analyst observation No public result supplied an exact harmful URL, captured response, file, payload, credential receiver, hash, or sandbox behavior trace for all-z.co.
The current external snapshot reported 49 harmless, six malicious, one suspicious, and 34 undetected engines. The adverse entries were domain-level blacklist results from BitDefender, CyRadar, G-Data, Lionic, VIPRE, Webroot, and ESET; separate report providers also retained Avira, Norton, and Bitdefender warnings. None of the available entries identified the exact URL or sample whose behavior produced the category. They document current reputation disagreement, not a reproduced phishing object.
- Page element External snapshot: 49 harmless, 6 malicious, 1 suspicious, 34 undetected.
- Analyst observation The adverse entries were blacklist-method domain results and did not name an exact all-z.co URL, response, file, payload, receiver, or hash.
all-z.co is a short-link redirect namespace, not an ordinary website. The root exposes no directory, sitemap, public creation interface, or complete list of active codes. Six public exact objects were found and reviewed, but the complete current, deleted, private, and future short-code namespace cannot be independently enumerated. A clean finite sample therefore cannot certify every destination; any future abuse report must identify the exact short URL and its user-visible destination.
-
HTTP status
404 - Analyst observation No public directory, sitemap, or link-creation interface was exposed by the reviewed root.
- Analyst observation Six known codes were reviewed, but the complete short-code namespace was not publicly enumerable.
Scope and limitations
- The exact submitted host is the registrable parent domain, so exact-host and parent-domain OSINT refer to the same all-z.co namespace; the nonexistent www alias was checked separately.
- The review covered the fresh Gridinsoft result, the root, error paths, six public exact short codes, their current destinations, multiple browser and crawler profiles, DNS, TLS, public URL intelligence, threat-intelligence context, phishing feeds, sandbox search indexes, and archive availability.
- The complete current, deleted, private, and future short-code namespace is not publicly enumerable. Six known public objects were reviewed, but no statement is made about unobserved codes.
- Destination pages were checked through their redirect chains. Cloudflare challenged automated retrieval of the final PDF bodies, so the review relied on the exact official www.allianz.co destinations and independently indexed Allianz document context rather than claiming a full byte review of every PDF.
- Conditional, geographic, account-bound, language-dependent, referrer-dependent, or time-limited destinations could differ outside the reviewed request profiles and locations.
- Public search, urlscan, OTX, archive, feed, and sandbox indexes are finite. Absence from those indexes does not prove that no unindexed historical object ever existed.
- Direct URLhaus and ThreatFox query APIs required authorization. Their current public export/feed files were checked separately, and unavailable interfaces were not treated as proof of safety.
- External blacklist labels remain independently controlled context. They are not equivalent to a current reproducible malicious URL or sample and did not determine the Gridinsoft verdict.
- The verdict does not certify every current or future short link as safe and is not a guarantee against later content or destination changes.
Help protect others by sharing this page on social media! The more people who know about all-z.co, the fewer chances they have to deceive someone else. Help others evaluate all-z.co by sharing this page on social media!