What Gridinsoft observed on Centerforonlineevangelism.org
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260903174714-dc3058ea
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The current review does not support the broad Phishing category: the live apex and www flows remained on the expected nonprofit ministry site, and the exact /wp-content/ path that redirected off-domain in July 2025 now returned an empty response without a redirect across multiple request profiles and two network locations. However, a domain-wide Safe result is not justified. The live homepage exposed GiveWP 4.16.5.1, which remains within the affected range for CVE-2026-82222 and contradicts the claim that this vulnerability was fully patched. The 2025 exact redirect is concrete historical compromise evidence, while current vendor warnings are domain-only blacklist context and do not identify a live harmful sample. The accurate current Gridinsoft category is therefore Suspicious Website.
Analyst findings
Review 8 documented observations View evidence
HTTP apex, HTTPS apex, and HTTP www entry points converged on the HTTPS www homepage. The final page returned HTTP 200 from the expected Center for Online Evangelism WordPress site. No unrelated redirect occurred in these entry flows. DNS resolved apex and www to the same current server, and both names presented a valid certificate covering the domain.
-
HTTP status
200 -
Final URL
https://www.centerforonlineevangelism.org/ - Page element Title: Center for Online Evangelism
- DNS fact centerforonlineevangelism.org and www.centerforonlineevangelism.org resolved to 174.136.29.221 during the review.
- Certificate fact The current TLS certificate validated for centerforonlineevangelism.org and www.centerforonlineevangelism.org.
The current Yoast sitemap index exposed post, page, donation-form, category, tag, and author maps. A bounded HTTP crawl assembled 379 entry-point and sitemap targets, including pages, images, and document URLs. No completed request ended on an unrelated domain, no password field or automatic executable delivery was found, and forms posted to the same site. Expected analytics, video, mailing-list, donation, and content-delivery services were present. Some later requests were rate-limited by the site's Wordfence protection and are recorded as a limitation.
-
HTTP status
200 - Public artifact URL https://www.centerforonlineevangelism.org/sitemap_index.xml
- Analyst observation The bounded crawl assembled 379 targets and recorded no off-domain final URL.
- Analyst observation No reviewed response contained a password input or automatic executable-download flow; parsed form actions were same-site GET or POST actions.
The exact path implicated by the 2025 incident was tested from two network locations with desktop, mobile, and search-bot request profiles and with no referrer, Google referrer, and Facebook referrer variants. Every current request returned HTTP 200 with a zero-byte body and no redirect. The former off-domain destination was not reproduced.
-
HTTP status
200 -
Final URL
https://centerforonlineevangelism.org/wp-content/ - File SHA-256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
- Analyst observation Nine profile and referrer combinations from one location and three apex or www variants from a second location returned zero bytes without a redirect.
The live homepage publicly reported WordPress 7.0.4 and GiveWP 4.16.5.1 and loaded GiveWP donation components. The current GiveWP security release identifies 4.16.7.2 as the release that hardens serialized-data handling for CVE-2026-82222; the disclosed affected range includes 4.16.5.1. The site's visible version therefore did not support the claim that this vulnerability was fully patched. Exploitation was not attempted, and this observation does not assert that the site is currently compromised.
- Page element Public generator metadata: Give v4.16.5.1
- Page element Public generator metadata: WordPress 7.0.4
- Public artifact URL https://wordpress.org/plugins/give/
- Analyst observation The live page exposed GiveWP donation JavaScript and linked the site's donation flow; no vulnerability exploit or destructive test was performed.
Public urlscan history preserves two scans from 2025-07-15 in which the exact /wp-content/ URL redirected off-domain to options.port.fccpool.com/pTamrPmH and displayed a German connection-verification page styled as a Cloudflare check. One scan was submitted automatically with PhishTank as its source. This is concrete historical URL behavior, not merely a domain blacklist category. Later scans on 2025-07-15 and 2025-07-16, and all available 2026 scans, returned the exact path without that redirect.
- Public artifact URL https://urlscan.io/domain/centerforonlineevangelism.org
-
Redirect destination
https://options.port.fccpool.com/pTamrPmH - Screenshot SHA-256 4c6f1b8d610a40667115a6b6b0d9a075381c9e685d6a5a25f51c4f7959ff12b1
- Analyst observation urlscan records 01980f75-8581-75e9-9270-75be751f0ba7 and 01980f83-622d-73cf-a797-e934f4cf08fb ended on the same off-domain URL on 2025-07-15.
- Analyst observation Subsequent public scans beginning later on 2025-07-15 no longer reproduced the off-domain destination.
urlscan returned 15 parent-domain records and five records whose final page host was www. The only recorded off-domain final pages were the two exact 2025 /wp-content/ incidents. OTX exposed two pulses, both sourced from dated copies of the same malware-filter domain list, and three URL observations whose available Google Safe Browsing fields had no matches. The current malware-filter list still names the apex as a domain only. URLhaus and ThreatFox APIs required authorization; Hybrid Analysis and Triage searches redirected without an accessible exact-host result. Unavailable sources were treated as unknown, not clean.
- Public artifact URL https://otx.alienvault.com/indicator/domain/centerforonlineevangelism.org
- Public artifact URL https://malware-filter.gitlab.io/malware-filter/phishing-filter-domains.txt
- Analyst observation The two OTX pulses were dated 2025-07-18 and 2025-07-31 and referenced the same malware-filter phishing-domain list.
- Analyst observation No accessible sandbox record supplied a current exact URL, file, payload, hash, credential receiver, or execution trace for the appealed host.
The public Wayback index returned 3,101 distinct successful archived objects from 2015 through 2025. Representative root snapshots from 2015, 2022, 2024, and 2025 consistently presented the Center for Online Evangelism ministry site. No successful archived snapshot of the exact /wp-content/ path was available. This continuity supports the site's stated long-running purpose but does not erase the separate 2025 redirect incident or prove current server integrity.
- Public artifact URL https://web.archive.org/web/20150811081755id_/http://www.centerforonlineevangelism.org/
- Public artifact URL https://web.archive.org/web/20250122223905id_/https://www.centerforonlineevangelism.org/
- Analyst observation The archive index contained 3,101 deduplicated HTTP 200 objects spanning 2015 through 2025, including 1,977 HTML objects and 11 PDF objects.
A fresh supported Gridinsoft scan reached the expected site and retained the older Phishing category without a current positive behavior signal. The current first-party review did not reproduce phishing, but it did identify the publicly exposed affected GiveWP version and the recent exact historical compromise path. The report was therefore corrected through the supported review flow to the narrower Suspicious Website category rather than being declared Safe.
-
HTTP status
200 - Public artifact URL https://gridinsoft.com/online-virus-scanner/url/centerforonlineevangelism-org
- Analyst observation Fresh report readback showed no current positive behavior signal and the expected Center for Online Evangelism title.
- Analyst observation Final supported report and policy readback showed Suspicious Website, category 14.
Scope and limitations
- The review covered public apex and www entry points, the public sitemap surface, forms, redirects, DNS, TLS, the exact formerly affected /wp-content/ path, public URL-scan records, threat-intelligence indexes, and representative archive snapshots. It did not audit the private server filesystem, database, administrator accounts, deployment history, or server logs.
- The bounded crawl assembled 379 targets. Eighty-one later responses were non-successful, including 65 Wordfence access-limit pages and 15 site-generated not-found pages; these were not treated as clean evidence. The completed requests did not end on an unrelated domain.
- No exploit attempt was made against GiveWP, and the public version string may reflect a cached presentation until the operator verifies the installed server files. The review establishes an exposed affected version, not successful exploitation or current compromise.
- The site's donation transaction was not submitted, no account was created, and no personal or payment data was entered. The review does not certify private or authenticated workflows.
- Public scanner, sandbox, search, certificate, threat-intelligence, and archive indexes are incomplete. URLhaus and ThreatFox required authorization, and inaccessible results were treated as unknown rather than clean.
- The appeal supplied no specific current allegedly malicious URL, file, or hash. The review distinguishes the concrete 2025 /wp-content/ redirect from current domain-only blacklist labels and does not claim a current malware payload, phishing receiver, or verified exploit.
Help protect others by sharing this page on social media! The more people who know about centerforonlineevangelism.org, the fewer chances they have to deceive someone else. Help others evaluate centerforonlineevangelism.org by sharing this page on social media!