[mdisraeli]

The Google results start with things like VirusTotal, which has several scannners which declares the gif as being a malicious site.

The gif itself is almost certainly not malicious. There's probably two things happening here. Firstly, the hosting domain of the gif scanned could be known to be malicious. And secondly and more generally, Cloudflare is heavily used by the criminal scene, so to play safe a number of scanners may flag any cloudflare element as malicious.

[joshmn]

Oh I wasn't implying that the gif was malicious. I was just saying that whatever script they're using for this is widely-used.

[mdisraeli]

I thought that was probably what you were doing, and it's a good check - one of the ones I tend to do myself when investigating strange things!

Just thought I'd add for other readers some security industry commentary :)