What Gridinsoft observed on Akutapro.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260825185228-75a3c28e
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent current review directly reproduced an active redirect service on akutapro.com. The unauthenticated /double endpoint accepted encoded external destinations, and a current /click URL redirected through that endpoint and an affiliate gateway to a gambling site. This supports a narrower Suspicious Website classification because the service can mask outbound destinations and remains actively used in large public redirect chains. The prior Browser Notification Spam category is not supported by the reviewed current root or redirect responses: no notification-permission prompt or browser-notification behavior was reproduced. No specific malware file, payload, credential receiver, exploit, automatic download, or malware hash was identified, so the verdict does not assert malware distribution.
Analyst findings
Review 9 documented observations View evidence
The current Gridinsoft report retained Browser Notification Spam from an existing stored category while its fresh report data contained no positive behavior signal and did not name an exact notification prompt, malicious URL, file, payload, exploit, command, or hash. The report therefore did not supply a reproducible current basis for the notification-spam behavior described by the broad category.
- Public artifact URL https://gridinsoft.com/online-virus-scanner/url/akutapro-com
- Page element Browser Notification Spam
- Analyst observation The current report's positive behavior signal list was empty and its retained classification source was the existing stored category.
Plain HTTP redirected once to the HTTPS apex. Desktop, mobile, and command-line requests to the current HTTPS root returned the same 109-byte empty HTML document with HTTP 200. The response contained no script, iframe, form, download, notification-permission request, fake verification prompt, popup, or off-site navigation.
-
HTTP status
200 -
Final URL
https://akutapro.com/ - MIME type text/html; charset=utf-8
- Analyst observation The complete root response was an empty HTML body and did not invoke the browser Notifications API or load another resource.
A current parameterized /click URL preserved in a public scan was requested directly. It returned HTTP 302 to the same host's /double endpoint, set tracking cookies, and then redirected through an affiliate gateway to the Betano gambling site. Repeating the request changed the generated tracking token while retaining the same destination family. No notification prompt, executable download, or malware payload was delivered in this reproduced chain.
-
HTTP status
302 -
Redirect destination
https://akutapro.com/double -
Redirect destination
https://gml-grp.com/ -
Redirect destination
https://www.betano.ca/ - Analyst observation The live /click path is an active advertising redirect flow, not a root-page browser-notification prompt.
The unauthenticated /double endpoint accepted encoded destination values and returned HTTP 302 to each of two benign analyst-selected external HTTPS destinations. A malformed non-URL value was redirected to a same-origin path. This directly demonstrates a destination-controlled public redirect surface that can mask outbound navigation behind akutapro.com.
-
HTTP status
302 -
Redirect destination
https://example.com/ -
Redirect destination
https://example.org/ - Analyst observation No account, authentication token, or destination allowlist was required to produce the two benign external redirects.
The public URLScan index returned 712 scans matching akutapro.com together with a click resource, including 48 scans during the preceding 30 days. Recent indexed chains reached gambling destinations through akutapro.com/click and akutapro.com/double, while exact root scans in June through August consistently recorded only the blank root response. A separate public urlquery record from April 2026 preserved a /click chain to Superbet and reported no network or threat-detection alert.
- Public artifact URL https://urlscan.io/result/01a035c9-02ef-72b8-8aff-975addc94abf/
- Public artifact URL https://urlscan.io/result/01a0088b-c110-746a-86b7-6a8ce4401b19/
- Public artifact URL https://urlquery.net/report/091b6595-f988-4f0b-a810-89c17296db1c
- Analyst observation The index volume documents repeated use of the exact redirect paths; it is not 712 independent malicious verdicts.
A public ANY.RUN visit to the exact root from August 2020 reported no threats, no malicious or suspicious indicators, and only a redirect to a blank page. Another public malware-analysis record contained a network request to akutapro.com from an unrelated executable, but it did not show that akutapro.com delivered that executable or any malware sample. The distinction between a contacted redirect domain and the analyzed malware file is material.
- Public artifact URL https://any.run/report/5a2f341255969a1aacbec6d7d78b075862b5b49279ce50bfa5fac1eecbea4b09/60dca4f1-e5e5-4d70-8819-c90fea937ca2
- Public artifact URL https://any.run/report/312f082ea8f64609d30ff62b11f564107bf7a4ec9e95944dfd3da57c6cdb4e94/37bf046a-7687-41dc-adbd-f011315d0e6f
- Analyst observation Neither public sandbox record establishes a malware payload served by akutapro.com.
The nearest available Internet Archive root snapshot from May 2026 contained the same empty 109-byte HTML page as the current root. The archive availability check returned no saved /click snapshot. The appealed exact host is the registrable parent domain itself; www.akutapro.com did not resolve during the review, so there is no separate parent-domain object to classify.
- Public artifact URL https://web.archive.org/web/20260516040306id_/https://akutapro.com/
- Analyst observation The archive sample supports a historically blank operator root but does not inventory parameterized redirect traffic.
The apex resolved to two Amazon-hosted IPv4 addresses and used Amazon Route 53 name servers. Its certificate matched akutapro.com and was valid from August 9 through November 7, 2026. These infrastructure facts support availability and transport identity but do not reduce the risk created by the destination-controlled redirect endpoint.
- DNS fact akutapro.com A 3.126.48.135 and 3.125.239.17
- DNS fact akutapro.com uses four awsdns name servers
- Certificate fact Let's Encrypt YR2 certificate for akutapro.com, valid from 2026-08-09T03:43:30Z through 2026-11-07T03:43:29Z
The reviewed root and redirect flows did not request browser notification permission and did not deliver an executable, archive, automatic download, credential form, exploit, or specific malware payload. The reproduced current risk is an active externally controllable redirect service and its use in advertising and gambling redirect chains.
- Analyst observation No specific malicious file, payload URL, payload hash, phishing receiver, or notification-permission prompt was identified.
Scope and limitations
- The review covered the current root, robots.txt, selected current /click and /double requests, two benign analyst-selected redirect destinations, DNS, TLS, public scan and sandbox records, and one retrievable archive snapshot.
- Parameterized redirect destinations can change per request, campaign, location, device, or time; the complete current and historical destination namespace is not publicly enumerable.
- No account was used, no advertisement was clicked beyond the bounded redirect chain, and no personal data, credentials, payment details, or executable sample was submitted.
- The finding does not assert that every destination is malicious, that gambling content is illegal, or that the domain operator authored the unrelated entry sites seen in public scan chains.
- URLhaus and ThreatFox public APIs required authorization and were not treated as clean results. AlienVault OTX returned no pulse reference at review time, which was recorded as absence from that index rather than proof of safety.
Help protect others by sharing this page on social media! The more people who know about akutapro.com, the fewer chances they have to deceive someone else. Help others evaluate akutapro.com by sharing this page on social media!