What Gridinsoft observed on cheapcigarette[.]net
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260901000933-8aced46e
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Shop
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent review supports changing the broad Phishing classification to Suspicious Shop. No malware or phishing object was reproduced. The narrower commerce-risk verdict follows from current first-party evidence: the checkout offers only bank transfer despite broader advertised payment methods; the refund policy remains a sample with unresolved contact and return-address placeholders; privacy and terms information is unavailable; and the current host's domain and displayed review identities are inconsistent. External blacklist labels were context only and did not determine this verdict.
Analyst findings
Review 6 documented observations View evidence
The apex, www alias, and public staging host served the expected WordPress and WooCommerce cigarette storefront. The reviewed root, shop, product, account, cart, checkout, contact, company, payment, shipping, review, sitemap, and staging paths did not produce an unrelated final redirect, external form receiver, automatic executable or archive download, credential imitation, or current malware payload.
-
HTTP status
200 -
Final URL
hxxps://cheapcigarette[.]net/ -
Redirect destination
hxxp://cheapcigarette[.]net/ and hxxps://www[.]cheapcigarette[.]net/ converged on hxxps://cheapcigarette[.]net/ - Page element The product sitemap listed 25 product pages plus the shop page.
- Analyst observation No reviewed page exposed an executable or archive link, meta refresh, unrelated final redirect, or automatic download.
- Analyst observation hxxps://staging[.]cheapcigarette[.]net/ returned HTTP 200 with the same storefront title and same-site shop structure.
A representative available product was added to a same-site cart without submitting an order. The checkout collected ordinary billing and shipping information and offered only direct bank transfer, while the site's current Payment Methods and Store Locator pages state that credit cards, Visa, MasterCard, Apple Pay, Google Pay, and bank transfer are accepted. The checkout itself says that only bank transfers are accepted.
- Page element Manchester Blue Crush 20s (10 Pack), AUD 200.00
- Page element Direct bank transfer
- Page element We only accept bank transfers to help prevent credit card fraud.
- Page element Payment Methods states Google Pay, Apple Pay, Credit Card, Visa, MasterCard, and Bank Transfer.
- Analyst observation The checkout form posted to hxxps://cheapcigarette[.]net/checkout/ and no order or payment was submitted.
The published Refund and Returns Policy identifies itself as a sample page and retains unresolved placeholders for the support email and physical return address. Common privacy and terms paths return HTTP 404, and neither appears in the current page sitemap, even though checkout collects a customer's name, address, phone number, and email.
- Page element This is a sample page.
- Page element {email address}, {physical address}, and {email} remain in the current refund text.
-
HTTP status
404 - Analyst observation The reviewed privacy, privacy-policy, terms, terms-conditions, and terms-and-conditions paths returned HTTP 404.
- Analyst observation The checkout requests billing name, postal address, phone number, and email before order placement.
The current site repeatedly presents the business as cheapcigarette.com.au even though the reviewed host is cheapcigarette[.]net and the referenced com.au domain did not resolve. The About page displays a Trustpilot-labelled 4.8 out of 5 based on 347 reviews without review entries. Its footer uses a Shopper Approved link containing the com.au name, but that URL redirects to a Shopper Approved profile for cheapcigarette[.]net rather than substantiating the displayed Trustpilot claim.
- Page element Welcome to CheapCigarette.com.au.
- DNS fact cheapcigarette.com.au returned no DNS address record during the review.
- Page element Trustpilot 4.8 out of 5 based on 347 reviews
- Page element The rendered Trustpilot-labelled review grid contained no review entries.
- Public artifact URL hxxps://www[.]shopperapproved[.]com/reviews/cheapcigarette[.]net
- Analyst observation The footer's com.au Shopper Approved URL redirects to the cheapcigarette[.]net profile; it does not substantiate the Trustpilot-labelled 347-review claim.
Exact-host and parent-domain OSINT covered public search indexes, urlscan, AlienVault OTX, OpenPhish, certificate transparency, malware-sandbox searches, threat-intelligence services, and web archives. urlscan returned no public scan record, OTX returned zero threat pulses, and exact public searches did not expose a current object-level malware sample or phishing receiver. Authorization-only or unavailable services were recorded as unverified rather than clean.
- Public artifact URL hxxps://urlscan[.]io/domain/cheapcigarette[.]net
- Public artifact URL hxxps://otx[.]alienvault[.]com/indicator/domain/cheapcigarette[.]net
- Analyst observation urlscan search returned zero public records for the apex, www, and staging hosts.
- Analyst observation OTX returned zero pulses for the apex, www, and staging hosts; its one apex URL observation contained no Google Safe Browsing match.
- Analyst observation The reviewed OpenPhish public feed had no exact-domain match. URLhaus and ThreatFox APIs required authorization and were treated as unverified.
- Analyst observation Exact public searches of ANY.RUN, Hybrid Analysis, Triage, PhishTank, URLhaus, and ThreatFox exposed no current sample tied to the reviewed hosts.
The current net domain registration dates to 2026-07-08. Wayback returned older root records from 2003 through 2014 and one current-namespace image from 2026-08-15, but no current root capture establishing the present storefront's longer history. Certificate transparency also exposed the active staging host. These facts provide continuity and scope context but do not establish malware or transaction fraud.
- DNS fact Registry creation date: 2026-07-08T12:02:09Z
- Certificate fact The active apex certificate covers cheapcigarette[.]net and *.cheapcigarette[.]net.
- Certificate fact Certificate Transparency recorded staging.cheapcigarette[.]net on 2026-08-28.
- Analyst observation Wayback returned 33 digest-collapsed HTTP 200 namespace rows, mostly from 2003-2015, plus one 2026 image; it returned no current staging-root record.
- Analyst observation Common Crawl was unreachable from the review environment and was recorded as unavailable.
Scope and limitations
- No order or payment was submitted, and product delivery, refund handling, bank-account ownership, and post-sale support were not tested.
- Private administrator accounts, server files, logs, databases, payment-provider systems, and customer records were not accessed.
- Public search, sandbox, threat-intelligence, and archive indexes are incomplete; unavailable or authorization-only sources were treated as unverified rather than clean.
- The verdict applies to the public apex, www, staging, product, cart, checkout, account, company, policy, DNS, TLS, and archive scope reviewed at the recorded time and does not certify future content or every transaction.
Help protect others by sharing this page on social media! The more people who know about cheapcigarette.net, the fewer chances they have to deceive someone else. Help others evaluate cheapcigarette.net by sharing this page on social media!