What Gridinsoft observed on Click.shootproof.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260829002731-c506bcb8
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Redirect Service — Exact-Object Review Required
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The current independent review contradicts the broad Phishing classification for click.shootproof.com: no live phishing page, credential receiver, malware delivery, malicious file, payload, or hash was reproduced on the reviewed operator surface or redirect chains. The exact host is a real click-tracking service, and public object history plus current replay show both legitimate gallery redirects and residual abused links toward deceptive but presently unavailable destination hosts. Because the token namespace is changing and cannot be exhaustively enumerated, a domain-wide Safe verdict is not supported. The accurate Gridinsoft operational category is Suspicious Website, while future abuse claims should identify the exact tracking URL and observed destination.
Analyst findings
Review 6 documented observations View evidence
The exact-host root returned a minimal ShootProof-branded HTTP 200 response through CloudFront. The tracking endpoint without a token returned HTTP 400 with a Wrong Link message and did not redirect.
-
HTTP status
200 -
Final URL
https://click.shootproof.com/ - Page element ShootProof - 200 OK
- Analyst observation A request to https://click.shootproof.com/ls/click without a token returned HTTP 400 and a Wrong Link response.
Current replay of public-indexed tracking objects showed mixed tenant-controlled destinations. Ordinary objects still redirected to ShootProof gallery hosts. Eight previously abused objects still redirected through i.gal toward four deceptive-looking Microsoft, banking, rail-delivery, or parcel-delivery destination hosts; those final hosts were unavailable by DNS failure or timeout during this review. Four other previously abused objects now ended with HTTP 404 before reaching their former destination.
-
Redirect destination
https://amyrosephotography.shootproof.com/ -
Redirect destination
https://missijns.shootproof.com/ -
Redirect destination
https://i.gal/ - Analyst observation Eight indexed tracking objects still produced a two-step redirect through i.gal toward four deceptive-looking destination hosts, but each final host was unavailable during the current replay.
- Analyst observation No current credential receiver, executable response, malware file, payload, or sample hash was obtained from the reviewed redirect chains.
The public URL-scanner index contained 333 records for the exact host. Its recent returned sample documented normal gallery redirects as well as January and February 2026 tracking URLs that reached deceptive Microsoft-subscription, banking, rail, and parcel-delivery lookalike hosts. The scanner records did not publish a malware-file verdict or sample hash for the exact host.
- Public artifact URL https://urlscan.io/result/019c3718-30dd-7356-90d8-4e4f361f8b6a/
- Public artifact URL https://urlscan.io/result/019c2c8e-f9c4-725d-976e-a660f6dba4e5/
- Public artifact URL https://urlscan.io/result/019fea7f-3777-704a-8181-c006acd979dc/
- Analyst observation The object history distinguishes real redirect abuse from a domain-only blacklist label: both expected and abusive destinations were recorded under the same tracking host.
A fresh supported Gridinsoft check reached the exact-host root with HTTP 200 and recorded no positive behavior signal. The reviewed evidence did not reproduce a live phishing page or malware delivery, so the broad Phishing category was corrected to Suspicious Website. The changing tracking-token namespace prevents an unconditional domain-wide Safe conclusion.
-
HTTP status
200 - Public artifact URL https://gridinsoft.com/online-virus-scanner/url/click-shootproof-com
- Analyst observation The current report contains no named malicious file, payload, exact active credential receiver, or sample hash.
The parent domain redirected to the expected ShootProof website, and public archive captures preserve the service at the same parent domain from July 2010. No successful Wayback capture was indexed for the exact click-tracking host.
-
Redirect destination
https://www.shootproof.com/ - Public artifact URL https://web.archive.org/web/20100711042555/http://www.shootproof.com/
- Analyst observation The archive continuity supports the operator identity but does not establish the safety of every tracking token or destination.
The exact host resolved through an Amazon CloudFront CNAME and presented a valid wildcard certificate covering shootproof.com and its subdomains. These facts are consistent with managed production infrastructure but do not determine the safety of delegated redirect destinations.
- DNS fact click.shootproof.com CNAME d2im85r0ovgi59.cloudfront.net
- Certificate fact Amazon RSA 2048 M04 certificate for *.shootproof.com, valid 2025-11-24 through 2026-12-22
Scope and limitations
- The review covered the exact-host root, the invalid-token endpoint, representative public-indexed tracking tokens, their current redirect chains, DNS, TLS, public scanner records, threat-intelligence context, and archive records; it did not enumerate private or unindexed tracking tokens.
- The unavailable final hosts prevented inspection of their former page bodies, forms, downloads, or server-side behavior. Their deceptive names and preserved scanner destinations do not by themselves prove a current credential receiver or malware payload.
- No successful Wayback capture was indexed for click.shootproof.com, so the exact host's older operator responses could not be reconstructed from that archive.
- Absence from a public sandbox or feed is not proof that an object was never abusive, and a domain-list entry is not equivalent to an observed harmful URL, file, execution trace, or sample hash.
Help protect others by sharing this page on social media! The more people who know about click.shootproof.com, the fewer chances they have to deceive someone else. Help others evaluate click.shootproof.com by sharing this page on social media!