Phishing protection dont get triggered at certain case. Steps:- 1. goto http://antispyware-pack.co.cc/fast-scan/ - Phishing protection get triggered. 2. goto http://tinyurl.com/trap-user result:- It get redirected to http://antispyware-pack.co.cc/fast-scan/ but no Phishing protection screen. Expected:- Phishing protection screen popup. When you got http://tinyurl.com/trap-user make sure you have automatically forwarded to http://antispyware-pack.co.cc/fast-scan/ and seeing "

Good catch! The redirect actually takes me to http://antispyware-rebate.co.cc/fast-scan/ or http://antispyware-gmail.co.cc/fast-scan/ (note -rebate/-gmail and not -pack). I have reported the site from Help -> Report Web Forgery and encourage you to do the same. (Marking this INVALID as Firefox is working exactly as expected in this case.)

Problem is complicated. 1. my URL http://tinyurl.com/trap-user redirect to google 2. Google access http://revcon.osce.org/revcon/1/94.php?q=mozilla-thunderbird-3 in the IFRAME/FRAME which is Organization for Security and Co-operation in Europe | OSCE 3. which access target of tinyURL http://tinyurl.com/trap-user-2 (preview http://preview.tinyurl.com/trap-user-2 ) ie, http://gvknnfev.cw.cm/ (cw.cm is a free domain service provide) 4. http://gvknnfev.cw.cm/**** is redirect to http://antispyware-*****.co.cc/fast-scan/

I have submitted a report against http://gvknnfev.cw.cm/ === report comment ======== They are redirecting to http://antispyware-*****.co.cc/fast-scan/ See details at https://bugzilla.mozilla.org/show_bug.cgi?id=648203#c2 === report comment end ========

looks like culprit is http://revcon.osce.org/revcon/1/94.php?q=a if the referrer is google it send back "CURRENTLY" active http://***.cw.cm/**** which is redirect to latest http://antispyware-*****.co.cc/fast-scan/