What Gridinsoft observed on Tds.pdl-profit.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260830223555-2f636c07
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Traffic Distribution Service — Exact-URL Review Required
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The current independent first-party review did not reproduce phishing on tds.pdl-profit.com. The exact host is an independently confirmed click tracker; its root fallback and five sampled public tracker routes redirected to financial-service destinations without an observed credential-theft flow, executable download, malware payload, or specific harmful file. The current domain-level blacklist labels do not supply an exact malicious URL or behavior trace, so the broad Phishing classification is unsupported and should be corrected. The whole host cannot be certified Safe because campaign routes and destinations are dynamic and not fully enumerable; the appropriate result is inconclusive with a narrower Suspicious Website caution category and exact-URL review required for future abuse claims.
Analyst findings
Review 8 documented observations View evidence
A fresh supported Gridinsoft rescan retained the broad Phishing category but recorded no positive first-party behavior signal and named no exact malicious URL, credential receiver, malware file, payload, or hash. The external matrix contained four malicious and one suspicious result, each identified as a blacklist method; 54 engines reported harmless. Separate direct providers returned Avira Safe, Norton safe, and Bitdefender not found.
- Public artifact URL https://gridinsoft.com/online-virus-scanner/url/tds-pdl_profit-com
- Page element Phishing
- Analyst observation The fresh raw report contained no positive first-party behavior signal and no exact harmful object.
- Analyst observation The current external matrix was 54 harmless, 4 malicious, 1 suspicious, and 31 undetected; all five warnings used the blacklist method.
Five repeated browser-like and command-line requests to the exact host root consistently produced one external redirect to a Fastloan loan-comparison page. The reviewed destination HTML presented financial offers and outbound offer links. It did not contain a password form, executable or archive link, automatic file delivery, third-party login impersonation, or a malware payload.
-
HTTP status
302 -
Redirect destination
https://fastloan.in.ua/v/9sld1 -
HTTP status
200 - Page element Fastloan
- Analyst observation The same destination was reproduced in five requests; no credential receiver, executable download, malware payload, or harmful file was identified.
Five exact public tracker routes found in the urlscan index were requested directly. Four completed at public financial-service or loan pages on sgroshi.com.ua, fia2.mx, and alexcredit.ua. One route passed through several destinations and ended at yui.homes with HTTP 403. No reviewed response delivered an executable, archive, malware payload, or observed credential-exfiltration flow, but the differing destinations demonstrate that the host is a dynamic redirect namespace rather than one fixed website.
- Public artifact URL https://urlscan.io/result/01a00194-4813-714f-a2a4-5a3e2d966444/
-
Redirect destination
https://sgroshi.com.ua/ -
Redirect destination
https://fia2.mx/ -
Redirect destination
https://alexcredit.ua/ -
Redirect destination
https://yui.homes/ -
HTTP status
403 - Analyst observation The finite route sample did not reproduce phishing or malware delivery, but it showed campaign-dependent off-site destinations.
Google Ads' current official list identifies PDL-Profit, COREVALUES LTD, and tds.pdl-profit.com as a certified click tracker. Independent affiliate-network references also identify the exact host as PDL-Profit's tracking domain. This supports the operator's explanation of the redirect function, but click-tracker certification does not certify every advertiser, campaign URL, or final destination as safe.
- Public artifact URL https://support.google.com/google-ads/answer/13707634
- Page element PDL-Profit | COREVALUES LTD | tds.pdl-profit.com
- Public artifact URL https://www.wowtrk.com/network/pdl-profit
- Analyst observation Certification confirms the click-tracking role; it is not a security verdict for every routed destination.
The public urlscan search reported 152 records mentioning the exact host; among the first 100 returned records, 24 were submissions of exact tds.pdl-profit.com URLs and resolved mostly to financial-service destinations. AlienVault OTX exposed no exact-host pulse and no malware sample; parent-domain URL observations contained tracker routes without a Google Safe Browsing match. Current URLhaus, OpenPhish, and Phishing.Database public feeds contained no exact-host or parent-domain entry. These are bounded public-index results, not proof that every route is clean.
- Public artifact URL https://urlscan.io/search/
- Public artifact URL https://otx.alienvault.com/indicator/domain/tds.pdl-profit.com
- Analyst observation urlscan reported 152 mentions; 24 of the first 100 returned records were exact-host URL submissions.
- Analyst observation OTX returned zero exact-host pulses and zero malware samples; its parent-domain URL observations showed no Google Safe Browsing match.
- Analyst observation No exact-host or parent-domain match was present in the current URLhaus, OpenPhish, or Phishing.Database public feeds checked during the review.
Internet Archive indexed four distinct successful exact-host objects: a root tracker request from April 2025, a tracker route from August 2025, a JSON consumer route from May 2022, and robots.txt from November 2020. The two retrieved tracker captures had empty response bodies and did not preserve a harmful destination or payload. The parent domain had repeated successful homepage captures from April 2020 onward, and current RDAP records registration on June 12, 2019.
- Public artifact URL https://web.archive.org/web/20250415150135id_/https://tds.pdl-profit.com/
- Public artifact URL https://web.archive.org/web/20260213062914id_/https://pdl-profit.com/
- Analyst observation The exact-host archive sample did not preserve a credential receiver, executable, malware payload, or harmful final destination.
- DNS fact pdl-profit.com was registered on 2019-06-12 and currently uses ns1.digitalocean.com, ns2.digitalocean.com, and ns3.digitalocean.com.
The exact host resolved to a dedicated DigitalOcean address and presented a currently valid certificate for tds.pdl-profit.com. The parent domain resolved separately and presented the public PDL-Profit operator site. This separation is consistent with a dedicated traffic-distribution host, while infrastructure continuity and valid TLS do not prove the safety of every routed object.
- DNS fact tds.pdl-profit.com A 138.68.109.148
- DNS fact pdl-profit.com A 165.227.173.250
- Certificate fact Sectigo certificate for tds.pdl-profit.com and www.tds.pdl-profit.com, valid from 2026-05-29 through 2026-12-13.
- Page element PDL-Profit - an international CPA platform in the financial vertical
The security-relevant surface is the set of campaign-specific tracker routes and their changing final destinations. No allegedly malicious exact URL was supplied, and the complete active, expired, private, geographically conditional, device-dependent, and future route namespace cannot be enumerated from the public root. A clean root fallback and finite route sample therefore cannot support a domain-wide Safe verdict.
- Analyst observation A future phishing or malware claim must identify the exact tracker URL, observed redirect chain, final destination, and harmful behavior.
- Analyst observation Removing an unsupported Phishing description is not a certification of every current or future campaign destination.
Scope and limitations
- The review covered the current Gridinsoft report, the exact root fallback, five exact tracker routes from public indexes, their current redirect chains, the parent operator surface, DNS, TLS, public threat-intelligence and phishing feeds, urlscan records, and archive snapshots.
- No complete inventory of active, expired, private, geographically conditional, device-dependent, or future tracker routes and destinations was publicly available or supplied.
- No account, credentials, personal data, loan application, payment details, or state-changing campaign action was submitted. Destination pages were reviewed without completing financial-service onboarding.
- The Google Ads certification confirms the click-tracking function and permitted use in Google Ads; it does not certify every advertiser, offer, campaign URL, or final destination as safe.
- External providers control their own domain-level records. Their blacklist categories remain separate context and are not equivalent to a reproduced malicious URL, payload, credential receiver, or harmful behavior trace.
Help protect others by sharing this page on social media! The more people who know about tds.pdl-profit.com, the fewer chances they have to deceive someone else. Help others evaluate tds.pdl-profit.com by sharing this page on social media!