Phishing URL initially not detected by the antivirus, but detected by LinkChecker

kdx200

I got an email with a link from [link removed by admin] and clearly it is a phishing link. Bitdefender did not catch it but when I entered it into https://www.bitdefender.com/en-us/consumer/link-checker it says:

Definitely Don’t Go There

Warning: this link is not safe.
Don’t wait until it’s too late. Our top-rated security blocks threats like this before you click. Start your 30-day free trial today!

Why didn't it catch it?

Alexandru_BD

Hello,

I think one possible explanation is that the URL may not have been classified as malicious when the email arrived or when the antivirus first saw it. By the time you pasted it into Link checker, the cloud reputation system may already have updated its verdict. It's also possible that Link checker may not be making the same decision at the same moment, with the same inputs, or through the same scanning path. Another thing to keep in mind is that Link checker performs an active, on demand URL check, to inspect destination behavior, and query current reputation systems. The web protection component in the antivirus may only intervene when the user actually opens the URL in a browser or when traffic matching the malicious destination is observed.

And one more thing, since you've mentioned that the link arrived via email. Email scanning is not the same as URL crawling. A security software may scan the email body or attachment, but it may not fully visit every embedded link in every message, especially if that would cause privacy issues, trigger tracking pixels, follow personalized links, or interact with phishing infrastructure. If there's a threat, the antivirus will block access to the malicious URL when clicked upon.

I guess my point here is, this event doesn't necessarily mean the antivirus failed in the malware-detection sense. It could mean the phishing URL was newly created, used redirect tricks, or was classified by Link checker after the antivirus first encountered it. But of course I can't exclude an incorrect detection as well, so a false negative.
If you wish to pursue this and dive into more technical details, you can report the URL to Bitdefender Labs through their submission form here:

https://www.bitdefender.com/consumer/support/answer/29358/

The security researchers can then analyze the URL and the detection, and come with a final verdict, if it was a false negative on the antivirus side, or not.

Regards