bit.ly itself does not distribute malware, bit.ly is just an URL shortener service which allows you to mask/shorten your original URL.
bit.ly however is not only used for good reasons (shortener) and for marketing reasons (click tracking).
You have to think about scam and phishing websites as well, which often use bit.ly to hide their domain which otherwise would be blacklisted automatically by filter programs (or to override blacklists). This simple act of piggybacking hurts bit.ly because it offers a simple redirection, and Google interprets this (probably it has been triggered automatically from their systems) as bit.ly being part of a malware network.
This can be easily confirmed if you visit the Google Safe browsing diagnostic page for bit.ly
Of the 91854 pages we tested on the site over the past 90 days, 669
page(s) resulted in malicious software being downloaded and installed
without user consent. The last time Google visited this site was on
2014-10-24, and the last time suspicious content was found on this
site was on 2014-10-24. Malicious software includes 200 trojan(s), 185
exploit(s), 152 scripting exploit(s). Successful infection resulted in
an average of 3 new process(es) on the target machine.
Malicious software is hosted on 365 domain(s), including
xxxx.mobi/, xxxx.net/, xxxx.com/.
As you can see, Google associates bit.ly with each of these single domains.
To answer your question, you shouldn't worry about the bit.ly website itself and you can browse it safely, however when clicking to a shortened URL there's generally no way (for bit.ly specifically there's a way, check Sumurai8's comment below) to prevent you being warped into a scamming/phishing site.
You can take precautionary measures by using various extensions on your browser, especially ones which allows you to prevent to run javascript on unknown pages, adblock might be a good thing also to prevent scammers to generate any income from banners/ads placed on the malicious site. You can also block and analyze the bit.ly redirection before it triggers on your browser, so you can know which URL you are going to be redirected to.
On a rule of thumb I'll generally recommend the following:
- Triple check the address bar, specifically the domain of the website
- Check again on google if not sure
- If it's a suspicious and dodgy page, leave and never come back, it might be good if you can blacklist and block it from being accessed again.
- Don't download warez and free programs promising you hot girls, money or whatsoever.
- For whatever service you use on the internet, if it involves serious personal stuff always use if possible a 2-way factor authenticator by attaching it to your mobile, this might dampen the probabilities from being scammed.
