What Gridinsoft observed on Balesia.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260902172854-78f2ec73
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review supports Safe for the observed public deployment of balesia.com. HTTP and www entries converged on the same HTTPS corporate site, five request profiles returned byte-identical content, and the reviewed page and JavaScript exposed no credential lure, harmful redirect, form, executable or archive delivery, payload, or observable harmful action. Public urlscan history proves a real March 2023 Trust Wallet impersonation on the former 209.45.87.171 server, while the current deployment uses 82.25.81.25; later archives show the Balesia corporate site, the old IRS-themed path returns 404, and an OTX-listed WordPress path now serves the exact root document. Remaining external warnings are domain-level blacklist or reputation labels without a current harmful object. They remain contradictory context but do not support retaining Gridinsoft's former Phishing classification. The broader prior-compromise claim is confirmed; the casino-specific content claim was not independently reproduced.
Analyst findings
Review 10 documented observations View evidence
The fresh Gridinsoft report reached the expected Balesia Group site through a same-site HTTP-to-HTTPS redirect. Before the decision it retained a broad Phishing classification dating from the former deployment, but the current first-party observation set identified no harmful URL, credential receiver, file, payload, hash, exploit, or unrelated redirect. That stored classification conflicted with the reproducible current result and was removed; the current Gridinsoft report shows Safe.
- Public artifact URL https://gridinsoft.com/online-virus-scanner/url/balesia-com
-
HTTP status
200 -
Final URL
https://balesia.com/ - Page element Balesia Group · Family Office
- Analyst observation The pre-decision Gridinsoft report did not identify a current harmful object or harmful-behavior observation.
HTTP apex and the www HTTPS entry converged on https://balesia.com/. Desktop, mobile, Googlebot, Gridinsoft-scanner, and Google-referrer request profiles all returned HTTP 200, the same 23,518-byte HTML response, the same response SHA-256, and identical normalized visible text. The page consistently identified Balesia Group and its telecom, technology, infrastructure, finance, and commerce portfolio. No request-profile-dependent destination or unrelated-brand login was reproduced.
-
HTTP status
200 -
Final URL
https://balesia.com/ -
Redirect destination
https://balesia.com/ - Page element Balesia Group · Family Office
- File SHA-256 fa16f8db7ddc35cd08114091036427d68ea2ae50f86f08700248599d2b8fb6ab
- Analyst observation Five representative request profiles returned byte-identical HTML and identical normalized visible text.
The reviewed page was a static corporate presentation with same-document section navigation, a mailto contact link, local image and style assets, Google Fonts, and explicit links to named portfolio companies. It contained no form, password field, iframe, executable or archive link, automatic download, meta refresh, obfuscated code, credential receiver, wallet-secret request, or automatic unrelated redirect. The reviewed JavaScript implemented visual effects, menu behavior, counters, and user-clicked portfolio links only.
- Public artifact URL https://balesia.com/
- Public artifact URL https://balesia.com/assets/js/app.js
- Page element mailto:[email protected]
- Analyst observation No current form, password field, iframe, automatic download, executable or archive link, credential receiver, wallet-secret request, or obfuscated navigation call was found.
Public urlscan history provides concrete object-level evidence of a former compromise. On 2023-03-30 the exact HTTPS apex on the former 209.45.87.171 server returned a page titled 'Best Cryptocurrency Wallet | Ethereum Wallet | ERC20 Wallet | Trust Wallet'. Two further scans on 2023-03-31 observed the same wallet-themed response. This was a real captured deceptive response on the old deployment, not merely a domain blacklist label.
- Public artifact URL https://urlscan.io/result/7024c417-2838-4bde-804a-280070bb87ff/
- Public artifact URL https://urlscan.io/result/541b4c08-4e79-4390-9188-cfce70c8642c/
- Public artifact URL https://urlscan.io/result/98bf7b1f-8a53-4746-893e-2756ba0b7105/
- Page element Best Cryptocurrency Wallet | Ethereum Wallet | ERC20 Wallet | Trust Wallet
- DNS fact The March 2023 wallet-themed response was observed on 209.45.87.171, not the current 82.25.81.25 deployment.
A 2019 urlscan submission for /irs/identity.php reached a hosting suspension page rather than a captured phishing form. The same exact path now returns HTTP 404. OTX currently lists /wp-content/uploads/2019/07/admin-security/Chinese/ as a URL observation, but that path now returns the exact same 23,518-byte Balesia corporate HTML and SHA-256 as the root because of the site's fallback routing. Neither reviewed path currently exposes the historical object implied by its name.
- Public artifact URL https://urlscan.io/result/4509e952-8c7e-45a5-aae7-f12aec432aa7/
- Public artifact URL https://balesia.com/irs/identity.php
-
HTTP status
404 - Public artifact URL https://balesia.com/wp-content/uploads/2019/07/admin-security/Chinese/
- File SHA-256 fa16f8db7ddc35cd08114091036427d68ea2ae50f86f08700248599d2b8fb6ab
- Analyst observation The OTX-listed path currently returns byte-identical content to the root; the old IRS-themed path returns HTTP 404.
Public urlscan search returned 19 observations. Its two 2026 apex scans showed the Balesia Group site on the current 82.25.81.25 deployment and did not expose a malicious overall verdict. OTX contained 27 pulses, but the retrieved records were repeated bulk phishing-domain lists from two authors, with no validator record, reputation value, malware family, exact payload hash, or behavioral trace. Public exact-name searches did not expose an additional current sample record in URLhaus, ThreatFox, PhishTank, or public sandbox indexes; authentication-only sources were treated as unverified, not clean.
- Public artifact URL https://urlscan.io/domain/balesia.com
- Public artifact URL https://otx.alienvault.com/indicator/domain/balesia.com
- Analyst observation The latest two public urlscan apex observations showed the current Balesia Group page on 82.25.81.25.
- Analyst observation The retrieved OTX pulses were bulk domain-list memberships without a validated current object, malware family, payload hash, or execution trace.
The fresh external matrix contained 52 harmless, two malicious, two suspicious, and 34 undetected results after excluding Gridinsoft's own result. ADMINUSLabs and Chong Lua Dao retained malicious labels; alphaMountain.ai and ESET retained suspicious labels. The available records identified their method as blacklist and did not supply an exact current Balesia URL, captured deceptive response, credential receiver, file, payload, hash, or sandbox behavior. Avira and Norton also retained broad domain reputation warnings.
- Analyst observation Fresh external matrix: 52 harmless, 2 malicious, 2 suspicious, and 34 undetected results, excluding Gridinsoft's own classification.
- Analyst observation The remaining named detections were domain-level blacklist or reputation labels without an exact current harmful object in the retrieved evidence.
Internet Archive CDX metadata returned successful apex snapshots from 2016 through July 2026. The reviewed 2023-06-03 snapshot showed the Balesia telecom infrastructure and technology site, and later 2023, 2024, 2025, and 2026 root snapshots continued after the March 2023 urlscan incident. No retrieved archive or web-index result showed the casino pages described by the requester. The broader prior-compromise claim is supported by the captured wallet impersonation, while the casino-specific claim was not independently reproduced.
- Public artifact URL https://web.archive.org/web/20230603053015id_/https://balesia.com/
- Public artifact URL https://web.archive.org/web/20231003213619id_/https://balesia.com/
- Public artifact URL https://web.archive.org/web/20260708042430id_/https://balesia.com/
- Page element Balesia Group – A Leader In Telecom Infrastructure and Technologies
- Analyst observation The reviewed June 2023 snapshot showed the Balesia corporate site after the March 2023 wallet-themed incident.
The apex resolved to 82.25.81.25 and used AWS authoritative nameservers. DNSSEC had a published DS record. CAA authorized Let's Encrypt. SPF used Microsoft 365 with a hard fail, DMARC requested quarantine, and two Microsoft DKIM selectors resolved. The reviewed certificate covered balesia.com and www.balesia.com from 2026-08-07 through 2026-11-05. These controls are consistent with the reported remediation but were not treated as proof of safe content by themselves.
- DNS fact balesia.com resolved to 82.25.81.25 and used AWS authoritative nameservers.
- DNS fact DNSSEC DS, CAA for Let's Encrypt, Microsoft 365 SPF with -all, DMARC p=quarantine, and two Microsoft DKIM selectors were publicly resolvable.
- Certificate fact The reviewed certificate covered balesia.com and www.balesia.com from 2026-08-07 through 2026-11-05.
No specific current malware file, executable, archive, payload URL, payload hash, credential receiver, phishing form, unrelated redirect, or observable harmful action was identified in the reviewed current scope. The March 2023 Trust Wallet impersonation is concrete historical response evidence and materially different from the remaining simple domain blacklist categories. The exact appealed host is also the registrable parent domain; the www alias and towers.balesia.com certificate name were considered separately.
- Analyst observation No exact current malware file, executable, archive, payload URL, payload hash, credential receiver, phishing form, unrelated redirect, or reproducible harmful action was identified.
Scope and limitations
- The appealed exact host is also the registrable parent domain, so exact-host and parent-domain OSINT refer to the same balesia.com apex. The www alias and towers.balesia.com certificate name were considered separately.
- The review covered the current Gridinsoft report, HTTP and www redirects, five request profiles, the public root surface, linked assets and JavaScript, known historical paths, DNS, TLS, certificate history, public URL and threat-intelligence indexes, sandbox-index search, web search, and available root archive snapshots.
- The advertised sitemap.xml returned the same HTML document as the root instead of a URL inventory, so the review did not exhaustively enumerate every possible unlinked historical path. This limitation was offset by exact review of known historical and TI-listed paths but does not prove no other unindexed path exists.
- No form was submitted, no account was used, no personal information was entered, and no historical payload was downloaded or executed.
- The review did not inspect private backend source, server files, databases, logs, administrator accounts, mailboxes, unpublished endpoints, or the internal cause of the historical compromise.
- The March 2023 wallet-themed apex response was captured by urlscan, but the retrieved public record did not provide an executable payload hash or sandbox execution trace. A specific malware family or real victim interaction is therefore not asserted.
- URLhaus and ThreatFox APIs required authorization, the Phishing.Database live feed was temporarily unavailable, and public search, URL-scanner, threat-intelligence, sandbox, certificate, and archive indexes are incomplete. Unavailable sources were treated as unknown, not clean.
- Safe describes the current observed public deployment and reviewed objects. It does not guarantee future content, private server state, account security, or that a removed compromise cannot recur.
Help protect others by sharing this page on social media! The more people who know about balesia.com, the fewer chances they have to deceive someone else. Help others evaluate balesia.com by sharing this page on social media!