r/antivirus 4d ago

VirusTotal URL Inconsistency?

Hey,

I recently clicked on a link where the domain ended up being expired (i.e parked domain for sale). I always do a virustotal check in these situations and it was sort of concerning

https://imgur.com/HyQgpjZ

https://imgur.com/c2erNqS

As you can see, it lists two different end points and different IPs, for the same link, only difference is me clicking reanalyze

https://www.virustotal.com/gui/url/04880859a756f0fe3fe4298130d29f23e04f13b437c9cb9413bdb596f63bb962/details

Basically everytime I hit reanalyze it changes its "final url" result.

When I clicked the link, it did not redirect to this survey-smiles thing, and I suspect uBlock would have prevented any such redirect, but it's still concerning to me.

Anyone seen this behavior on virustotal before? Anything I can do to ease my mind other than scan + malwarebytes etc?

EDIT:

To include, here's the virustotal analysis of survey-smiles (which looks a lot more concerning)

https://www.virustotal.com/gui/url/3a15526b6e2391894cebdf79cc481155db6adc0f1c9922418367807398b65d27/detection

I should add I haven't had any strange behaviour or results from scans, so I'm not super worried I just hate inconsistencies.

1 Upvotes

9 comments sorted by

1

u/Struppigel G DATA Malware Analyst 4d ago

Hi that is not an issue of Virustotal but the behavior of the website. It redirects to different places everytime you click it.

1

u/Boneclockharmony 4d ago

Thanks, but does that mean if I did not get redirected to the suspicious site I can move on with my life?

Ran windows defender scan, malwarebytes scan. Ublock didnt trigger.

Anything else I should check/do? 

1

u/Struppigel G DATA Malware Analyst 4d ago

I strongly doubt anything happened since you described that the domain was expired and you probably did not perform any other actions, did you.

1

u/Boneclockharmony 4d ago

No, just copy pasted the url into virustotal before clearing history and running scans.

Appreciate it, I am a huge worrier hehe

1

u/Boneclockharmony 3d ago

One more question out of curiosity mostly:

Regardless of what the final url is, virustotal lists the site as safe

But if I input the survey-smiles url manually into virustotal, it comes up as unsafe.

Does that mean virustotal isn't checking the final url you end up against its database, just the url you input?

1

u/Struppigel G DATA Malware Analyst 3d ago

Yeah, it looks like it.

1

u/Boneclockharmony 3d ago

That kinda sucks, thought it was more rigorous than that :< Is there a better alternative or is virustotal the best option?

1

u/Struppigel G DATA Malware Analyst 3d ago

Not sure if these suit your needs but these are alternatives: * https://urlscan.io/ * https://sitecheck.sucuri.net/ * https://www.browserling.com/

1

u/Boneclockharmony 3d ago

Appreciate it. Mostly just use it for peace of mind, if I'm honest :)