The person that created this has a wonderful sense of humor!

Great. Since shadyurl seems to have died

It may be possible to make a more-limited system without redirects, by abusing stuff like user:pass@host URL schemes, or #anchor suffixes... although it would be less reliable, some hosts/URLs would have problems.

Chaotic Neutral

This hilarious

Imagine if they later update these links to actually phish people. That'd be pretty funny.

Not bad!

https://carnalflicks.online/var/lib/systemd/coredump/logging...

Beautiful. I got my joy back

Bravo!

I know it's a joke and I had a sensible chuckle, but if you want to routinely use it at work, just keep in mind that it's probably gonna make things worse.

Since you can't exhaustively enumerate every good thing or every bad thing on the internet, a lot of security detection mechanisms are based on heuristics. These heuristics produce a fair number of false positives as it is. If you bring the rate up, it just increases the likelihood that your security folks will miss bad things down the line.

Nice. Suggestion: default to https instead of http. Wouldn't want the links to lead somewhere malicious by accident.

After half a decade on discord... What are the odds of me being banned for sending a ragebait google redirect to my buddies?

That is fucking hilarious

I laughed really hard, this is fantastic.

A whole new generation of rickrolling is about to begin.

https://cam-xxx.live/trojan-hunter/evil-snatcher/malware_cry...

Or just report their mandatory compliance emails as phishing attempts.

I’ve worked for multiple large companies where the annual IT security signoffs look exactly like malicious emails: weird formatting; originates from weird external url that includes suspicious words; urgent call to action; and threats of discipline for non-compliance.

All this money being spent on training, only to immediately lull users into accept threats.

Seems that the url validation is broken. It says that `http://test.example` is not a valid url

Reminds me of working at a company blocking access to eBay because their URL had .dll in there.

Also, we were thought to inspect the URL before clicking on it.

Except that the spam system they use completely mangles the URL...

All of this reminds me of a hilarious situation at a previous employer. As is standard corporate practice, they used to tell people to inspect links by hovering over them to confirm that they lead to the official website of the sender.

People kept falling for phishing links though, so they got a Trend Micro device to scan emails, which also rewrote every link in it to point to their URL scanning service, which means every link now looks like https://ca-1234.check.trendmicro.com/?url=...; I guess no one would be allowed to click on any link in an email at that company.

Of course, their URL rewrites also broke a good number of links, so you'd wake up to a production incident, and then have to get your laptop, log in manually to Pagerduty/Sentry or what have you, and look up the incident details from the email...