Yeah that's my best guess. I was shocked how much it was used for scams. Might also be possible the link is so suspicious looking it's actually more intriguing to click.
I made shadyurl! The subdomain feature in this is great. Also cool it has an API. Though with the amount shadyurl was abused by phishers, I'd be interested to see how long an API stays viable.