What Gridinsoft observed on Checkyout.app
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260901183616-d6cdd0a7
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent first-party review did not reproduce phishing, credential theft, malware delivery, an unrelated redirect, or another current harmful behavior on checkyout.app. The exact host, public service pages, login and contact surfaces, company identity, parent-domain namespace, DNS and TLS state, repeated content, and public URL-scanner history were consistent with the stated CheckYout hospitality-operations SaaS. Remaining adverse records were contradictory domain blacklist categories without a reproducible malicious object.
Analyst findings
Review 8 documented observations View evidence
The exact host returned the expected CheckYout service over HTTPS. Plain HTTP and www redirected only to the canonical HTTPS root, and three repeated HTTPS requests produced the same destination and identical response bytes.
-
HTTP status
200 -
Final URL
https://checkyout.app/ -
Redirect destination
http://checkyout.app/ redirected to https://checkyout.app/ -
Redirect destination
https://www.checkyout.app/ redirected to https://checkyout.app/ - File SHA-256 bd3282ccf6e3b33bd7edc4282c41db356aeb9bf2fc74c3c4540cb1790822a82e
- Analyst observation Three repeated root requests kept the same final host and returned identical content; no rotating or unrelated destination was observed.
The root, English service pages, contact page, imprint, privacy page, and login page consistently described a CheckYout vacation-rental checkout and cleaning-notification SaaS. The reviewed public content did not imitate an unrelated brand or present a failed-delivery, account-verification, payment, or recovery-seed lure.
- Page element Gast reist früher ab? Reinigungsteam wird per WhatsApp informiert
- Page element Anmelden – CheckYout
- Page element Contact & Support – CheckYout
- Page element Impressum – CheckYout
- Page element Datenschutzerklärung – CheckYout
- Analyst observation The reviewed public pages did not initiate an automatic executable, archive, installer, or other file delivery.
The public imprint and contact pages identified TEAM M digital GmbH, Mathias Büschlen, the Swiss address, and UID CHE-451.095.935. Public company and professional indexes independently matched the company name, address, UID, and managing person; this identity context corroborated the stated service but was not treated as security proof by itself.
-
HTTP status
200 - Page element TEAM M digital GmbH
- Page element CHE-451.095.935
- Page element Trogenstrasse 6, 3653 Oberhofen am Thunersee, Switzerland
- Public artifact URL https://www.zefix.admin.ch/de/search/entity/list/firm/1402564
- Analyst observation Independent public company-directory and professional-index records matched TEAM M digital GmbH, UID CHE-451.095.935, the Oberhofen address, and Mathias Büschlen.
The appealed host is the registrable parent domain itself. Public certificate records exposed only the root, www, and cleaners hosts; www canonicalized to the root, while cleaners returned a self-branded CheckYout cleaning-team login without an unrelated redirect.
- DNS fact Certificate transparency names: checkyout.app, www.checkyout.app, cleaners.checkyout.app.
-
HTTP status
200 -
Final URL
https://cleaners.checkyout.app/login - Page element Cleaners – powered by CheckYout
- Analyst observation No separate higher registrable parent domain exists for checkyout.app; the exact appealed host and parent domain are the same scope.
The root resolved to its current Vercel deployment, presented a valid certificate for checkyout.app, and returned transport and browser hardening headers consistent with the reviewed application.
- DNS fact checkyout.app resolved to 216.150.1.1 during the review.
- Certificate fact The Let's Encrypt certificate covered checkyout.app and was valid from 2026-07-26 through 2026-10-24.
- Page element Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
- Page element Content-Security-Policy restricted form submissions to self and framing ancestors to none.
Public URL-scanner and search indexes preserved a consistent CheckYout service from March through August 2026. Retrieved records showed the root service and the cleaners login without a concrete harmful path, payload, file, hash, or result-level malicious verdict.
- Analyst observation The urlscan search index returned 11 records dated 2026-03-29 through 2026-08-22, including repeated root scans and the cleaners subdomain.
- Analyst observation Repeated indexed root scans showed HTTP 200, the CheckYout product title, Vercel hosting, and the canonical checkyout.app destination.
- Analyst observation Wayback CDX returned no successful captures for the root or www host, so absence of archive material was treated as an evidence limitation rather than a clean result.
- Analyst observation Search indexes surfaced current product, FAQ, contact, cleaning-team, and blog pages consistent with the same service and did not surface a preserved exact malicious object.
Public threat-intelligence and sandbox searches did not surface a concrete malicious object for the exact host. OTX returned no pulse, OpenPhish had no exact match, and public sandbox searches did not expose an exact-host harmful execution report; authentication-only or unavailable sources were treated as unknown.
- Analyst observation OTX returned zero pulses for checkyout.app and www.checkyout.app.
- Analyst observation The OTX URL list contained root and www HTTP 200 observations and no Google Safe Browsing match in the retrieved records.
- Analyst observation OpenPhish contained no exact checkyout.app match at the recorded review time.
- Analyst observation URLhaus and ThreatFox public APIs required authentication during the check; Common Crawl and crt.sh were unavailable, so those sources were recorded as unknown rather than clean.
- Analyst observation Exact-host searches of public sandbox and URL-analysis indexes did not surface a report with a specific harmful execution trace, download, payload, or hash.
No specific malicious URL, file, payload, hash, external credential receiver, unrelated redirect chain, or harmful execution trace was identified. The remaining adverse evidence consisted of domain-level blacklist categories rather than an observable malicious object.
- Analyst observation The ticket and reviewed public records did not provide an exact harmful URL, file, payload, or hash for object-specific reproduction.
- Analyst observation Current external labels included phishing, malicious, and suspicious categories at the domain level but did not expose a reproducible malicious sample in the reviewed sources.
Scope and limitations
- The verdict applies to the public root, representative public pages, login surfaces, observed parent-domain namespace, redirects, DNS, TLS, and public index records reviewed at the recorded time; authenticated customer accounts, private data, server-side files or logs, and future changes were not assessed.
- No exact guest checkout token or cleaning confirmation token was supplied for object-specific review. The review therefore does not certify every private or customer-specific workflow instance.
- Wayback returned no successful captures, and several public intelligence APIs were unavailable or authentication-only. Those sources were treated as unknown rather than clean; urlscan and public search indexes supplied the available historical view.
- The absence of a reproducible object in the reviewed public sources does not prove that no historical abuse ever occurred; it means the current Phishing classification was not supported by reproducible first-party evidence in the reviewed scope.
Help protect others by sharing this page on social media! The more people who know about checkyout.app, the fewer chances they have to deceive someone else. Help others evaluate checkyout.app by sharing this page on social media!