What Gridinsoft observed on baikuder.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260903173912-fa772fd5
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context โ not used for this decision
The independent current review supports Safe for the observed public deployment of baikuder.com. All 51 current public pages and posts served the same office-supplies site without a phishing form, unrelated redirect, executable or archive delivery, malware payload, or harmful action. Public urlscan evidence confirms that /sima/index2.php was a concrete Microsoft-branded password prompt in October 2022 and that /sima.zip was recorded as a phishkit-tagged archive. Those exact paths now return HTTP 404 and are absent from the current inventory. The remaining SOCRadar and OTX indicators are current domain-level blacklist or bulk-feed context without a live exact object. They contradict the current first-party result but do not justify retaining a broad Gridinsoft warning for the deployment reviewed now. Continued WordPress hardening and monitoring remain appropriate because the historical incident was concrete.
Analyst findings
Review 8 documented observations View evidence
The HTTPS root served the Baikuder office-supplies site, and the HTTP root plus the www variants converged on the same HTTPS apex. The public WordPress API enumerated 12 pages and 39 product or news posts. All 51 unique current public URLs returned HTTP 200 on baikuder.com without an unrelated final host.
-
HTTP status
200 -
Final URL
https://baikuder.com/ - Page element The current public inventory contained 51 unique same-host pages and posts; all 51 returned HTTP 200.
- Page element The reviewed catalog presented desk organizers, filing and storage products, business supplies, writing supplies, and individual CLS product pages.
The About, Contact, policy, catalog, and product pages consistently identified Baikuder as the office-supplies brand of CLS Industry Inc. The contact details matched the separate CLS corporate site. The only form found in the current public inventory was a same-origin contact form requesting ordinary name, email, subject, and message fields; no password, one-time code, payment-card field, or unrelated-brand sign-in was present. The form was not submitted.
- Page element About and Contact pages identify CLS Industry Inc., its Taiwan address, [email protected], and +886-4-22352206.
- Public artifact URL https://www.cls.com.tw/CLS_Story.php
- Page element The contact form action was /contact/ on baikuder.com.
- Analyst observation No current public form requested a password, one-time code, payment-card number, wallet secret, or unrelated account credential.
The apex and www names resolved through Cloudflare and served the same site. The current certificate covered baikuder.com and *.baikuder.com from 2026-07-10 through 2026-10-08. DNS also published mail.cls.com.tw as the mail exchanger and a Google site-verification record. Shared Cloudflare addressing is infrastructure context and did not establish either harmful or safe behavior by itself.
- DNS fact baikuder.com and www.baikuder.com resolved to Cloudflare anycast addresses during the review.
- DNS fact The MX target was mail.cls.com.tw, and the apex published a Google site-verification TXT record.
- Certificate fact Let's Encrypt YE1 certificate valid 2026-07-10 through 2026-10-08 for baikuder.com and *.baikuder.com.
- Analyst observation Cloudflare shared-network placement was treated only as infrastructure context, not as a threat finding or a clean-site guarantee.
The complete current 51-URL public inventory and its WordPress-rendered content contained no link to an executable, installer, mobile package, script package, or archive. The reviewed navigation did not start an automatic download or an unrelated redirect, and no specific current malware file, payload URL, payload hash, credential receiver, exploit, or harmful action was identified.
- Analyst observation No .exe, .msi, .apk, .dmg, .zip, .rar, or .7z link was present in the current public page and post content.
- Analyst observation No automatic download, unrelated final host, current phishing form, malware payload, or harmful execution was reproduced.
Public urlscan records establish a concrete historical incident rather than only a domain label. On 2022-10-11, an OpenPhish-sourced scan of /sima/index2.php returned HTTP 200 with the title 'Sign in to your account'; the preserved screenshot showed a Microsoft-branded password prompt on the non-Microsoft baikuder.com host. A separate scan recorded /sima.zip as application/zip with miteru and phishkit tags. The ZIP bytes and a file hash were not available in the retrieved public record, so no malware-family or execution claim is made for that archive.
- Public artifact URL https://urlscan.io/result/00cc286b-e90d-4d7a-b357-cc493892c708/
- Public artifact URL https://urlscan.io/result/d98a3d83-428e-437e-b928-bd7fa9ae467b/
-
HTTP status
200 - MIME type application/zip
- Analyst observation The historical page visibly requested a password under Microsoft branding on baikuder.com; the retrieved evidence did not prove where submitted data was sent.
- Analyst observation The historical ZIP was recorded and tagged as a phish kit, but its bytes, hash, and sandbox execution trace were unavailable for this review.
The historical paths /sima, /sima/, /sima/index2.php, /sima/index2.php/, and /sima.zip each returned the current Baikuder HTTP 404 page as text/html. None appeared in the current public page or post inventory. Later urlscan observations from 2022 through 2026 show the credential path transitioning through 403 or 500 responses to ordinary 404 pages.
-
HTTP status
404 - MIME type text/html; charset=UTF-8
- Analyst observation All five tested /sima variants returned HTTP 404 and none was linked from the current 51-URL public inventory.
- Public artifact URL https://urlscan.io/domain/baikuder.com
The exact appealed host is also the registrable parent domain, so exact-host and parent-domain searches concern the same apex; www was checked separately. urlscan returned 25 public records, including the concrete 2022 phishing URL and ZIP, followed by later root pages and 404 responses. OTX returned repeated 2026 bulk-feed phishing pulses with baikuder.com as a domain indicator and seven URL observations; its latest root observation showed HTTP 200 with no Google Safe Browsing match. The current OpenPhish feed and exact public searches of Hybrid Analysis, Triage, ANY.RUN, URLhaus, and the exact historical URLs returned no current sample-level match. Authentication-only or unavailable APIs were not treated as clean evidence.
- Public artifact URL https://urlscan.io/domain/baikuder.com
- Public artifact URL https://otx.alienvault.com/indicator/domain/baikuder.com
- Analyst observation A precise historical phishing page was independently distinguishable from current domain-only blacklist and bulk-feed indicators.
- Analyst observation No current malware sample, payload hash, or live harmful exact URL was found in the reviewed public scanner, sandbox, threat-intelligence, or feed indexes.
The Internet Archive availability service reported successful apex snapshots from 2018-08-06 and 2019-08-15. It reported no stored snapshot for /sima/index2.php or /sima.zip. Direct replay and the CDX listing were unavailable during the review, so the archived apex content was not used to assert what those pages displayed. The current site and public registration data separately show long-running domain and business continuity.
- Public artifact URL https://web.archive.org/web/20180806074937/http://baikuder.com/
- Public artifact URL https://web.archive.org/web/20190815203022/http://baikuder.com/
- Analyst observation Archive availability identified two successful apex captures but no capture of either exact historical /sima object.
- Analyst observation Unavailable archive replay was recorded as a limitation and not interpreted as clean content.
Scope and limitations
- The appealed exact host is also the registrable parent domain, so exact-host and parent-domain OSINT both refer to the baikuder.com apex. The www variant was checked separately.
- The review covered the current Gridinsoft report, HTTP and www redirects, all 51 current public WordPress pages and posts, navigation, forms, linked downloads, the exact historical /sima paths, DNS, TLS, public URL scanners, threat-intelligence indexes, sandbox-index searches, a current phishing feed, and available archive metadata.
- No form was submitted, no account was created, no credential or personal information was entered, and no executable or archive was run.
- The review did not inspect private server files, logs, administrator accounts, mailboxes, unpublished endpoints, WordPress administration, or the internal cause of the 2022 phishing publication.
- The historic /sima.zip record exposed its URL, MIME type, and phishkit tag, but not retrievable bytes, a file hash, or a sandbox execution trace. No specific malware family or payload behavior is attributed to that archive.
- Internet Archive replay and CDX listing were unavailable, while its availability API reported apex snapshots but no snapshot for either exact /sima object. Unavailable or authentication-only sources were recorded as unverified, not as clean.
- Public search, URL-scanner, threat-intelligence, sandbox, feed, and archive indexes are incomplete; absence from an index does not prove that an unindexed event never occurred.
- Safe describes the public deployment and exact paths observed at the recorded time. It does not guarantee future content, private server state, WordPress plugin security, account security, or that a remediated compromise cannot recur.
Help protect others by sharing this page on social media! The more people who know about baikuder.com, the fewer chances they have to deceive someone else. Help others evaluate baikuder.com by sharing this page on social media!