What Gridinsoft observed on Url.sg
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260810051441-b5eb74d0
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- URL Shortening Service — Destination-Specific Review Required
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The reviewed root site and public service pages did not show behavior supporting the prior domain-wide Distributes Malware or Unwanted File Download classification, and no specific malware file, payload, URL, or hash was found there. However, url.sg is a user-controlled URL-shortening namespace whose individual short codes can redirect to destinations that were not enumerated or reviewed. The service root appears operational, but the safety of the whole domain is inconclusive and each suspicious short link requires destination-specific review.
Analyst findings
Review 6 documented observations View evidence
The reviewed public site presented a coherent URL-shortening and link-management service with substantive pricing, developer API, QR-code, bio-page, contact, account, and abuse-reporting interfaces.
- Page element The homepage described URL shortening, analytics, targeting, QR codes, link management, branded domains, and an authenticated developer API as parts of the same service.
- Page element Pricing, Developer API, QR Codes, Bio Pages, Contact, registration, and login pages consistently used the url.sg service identity and same-origin navigation.
- Page element The public Report Link page accepted reports for spam, fraudulent, malicious, or phishing short links through the same-origin /report/send endpoint.
Repeated direct requests to the root and reviewed public pages returned the expected same-site content without an unrelated redirect, conditional external destination, or automatic download.
-
HTTP status
200 -
Final URL
https://url.sg/ - Analyst observation Browser-like, curl, Googlebot, and Bingbot client profiles all received HTTP 200 at the same https://url.sg/ destination with the same URL-shortener page title and purpose.
- Analyst observation The reviewed pricing, developer, QR-code, bio-page, contact, report, registration, and login routes each returned HTTP 200 at their expected url.sg destination.
The reviewed public forms and client code used same-origin endpoints for shortening, authentication, contact, and abuse reporting; no credential forwarding to an unrelated host was identified in the reviewed public code.
- Page element The public shortening form posted a user-supplied destination to the same-origin /shorten endpoint and requested a Google reCAPTCHA token before submission.
- Page element Registration and login forms submitted to the same-origin /user/register/validate and /user/login/auth endpoints.
- Page element Contact and short-link abuse reports submitted to the same-origin /contact/send and /report/send endpoints.
- Analyst observation The public shortening workflow was not submitted because doing so would create a new public short link; the reviewed client code displayed the returned short URL and QR-code controls without initiating navigation or a download automatically.
The reviewed public scripts implemented ordinary interface, form, QR-code, and link-management behavior. No specific executable, malware payload, suspicious automatic download, or unrelated script-delivery mechanism was identified.
- File SHA-256 fc981871b8271bea9270a3af4f77bb50d37101e555dd6801fe7ecf9e26a9b12b
- File SHA-256 866fd618922d2dd69c88e27a3e7fb6c5b45663b37c07f7ef9e51186c38bc6bdc
- File SHA-256 63a9648e7ea1a3ac0bca8de86590edb953812f39d73fa222a397942dcf63c112
- Analyst observation QR-code PNG, PDF, and SVG download routes were attached to explicit user controls after a link is created; the reviewed code did not trigger them automatically.
- Analyst observation No specific malicious file, payload, URL, or hash was identified in the reviewed public scope.
The active hostname resolved through its published DNS and presented a currently valid HTTPS certificate and several response-security headers.
- DNS fact A records: 104.21.87.35 and 172.67.140.117; authoritative name servers: angela.ns.cloudflare.com and tom.ns.cloudflare.com.
- Certificate fact Google Trust Services WE1 certificate for url.sg and *.url.sg, valid from 2026-07-31 through 2026-10-29.
- Certificate fact The reviewed HTTPS response included X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Origin-Agent-Cluster, and cross-domain-policy restrictions.
The reviewed policy presentation was incomplete: the privacy-policy link returned a not-found page and the Terms and Conditions page contained placeholder text.
-
HTTP status
404 - Page element The Terms and Conditions page displayed the placeholder sentence: Please edit me when you can. I am very important.
- Analyst observation These are transparency and documentation weaknesses; they were not evidence of malware delivery in the reviewed site behavior or code.
Scope and limitations
- The review covered the root domain and listed public unauthenticated pages; no account was created, no credentials were submitted, and private dashboard, billing, administrative, and authenticated API flows were not accessed.
- The public shortening form was not submitted because that would create a new public short link. The form and its client-side behavior were reviewed without creating content on the service.
- A URL-shortening platform can redirect individual short codes to user-selected third-party destinations. This domain-level result does not certify every existing or future short code; a specific suspicious short link requires destination-specific review.
- The result applies to the site content, code, infrastructure, and behavior reviewed at the recorded time and does not predict future changes.
Help protect others by sharing this page on social media! The more people who know about url.sg, the fewer chances they have to deceive someone else. Help others evaluate url.sg by sharing this page on social media!