[ch0I9daAiO]

You can do the same with VirusTotal. Check the UA, if it's Virus Total, serve a legit page, if it's non VT, serve the malicious one. Simple 301 redirects will be detected and presented to the analyst, URL rewrites wont.