What Gridinsoft observed on Chosei-kai.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260903174836-87eabac2
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context โ not used for this decision
The independent first-party review confirmed that chosei-kai.com hosted a real Shaw-branded phishing page on two exact hidden paths in early May 2026, but those paths were blocked within days and now return HTTP 404 across multiple request profiles. The current apex, www alias, 79-page public sample, same-origin enquiry forms, redirects, DNS, and TLS were consistent with the stated Japanese medical organization, and no current phishing page, external credential receiver, harmful download, malware payload, or exploit was reproduced. Current external warnings are therefore contradictory broad reputation context rather than support for retaining a present domain-wide Phishing classification.
Analyst findings
Review 9 documented observations View evidence
HTTP on the registrable parent redirected once to the HTTPS apex, and HTTPS www redirected once to the same apex. The final page returned HTTP 200 as the Japanese Chosei-kai medical organization site. Desktop, mobile, Googlebot, Gridinsoft, and Google-referrer profiles produced identical normalized visible content; the reviewed root did not initiate an unrelated redirect or automatic download.
-
HTTP status
200 -
Final URL
https://chosei-kai.com/ -
Redirect destination
https://chosei-kai.com/ - MIME type text/html; charset=UTF-8
- File SHA-256 151897c29aed79b96bef5b9a0a4e9e1541433b1135635dabe6410f6ba2852140
- Page element The page title was ้ท็ไผ and the visible content described the Chosei-kai medical corporation and its hospitals.
- Analyst observation All five profiles had normalized visible-text SHA-256 51064254d30bcd24c10a1e96cbde25b29d3adc92e13c6e958a2f754129998c57.
A bounded two-level review requested 79 same-site pages discovered from the live navigation. Seventy-eight returned HTTP 200; one old image path returned HTTP 404. No reviewed page ended on an unrelated host, linked an executable or archive download, embedded an external credential form, or exposed a file-upload interface. External navigation was limited to Google and Google Maps hosts.
- Analyst observation 79 same-site pages were requested: 78 returned HTTP 200 and one obsolete GIF path returned HTTP 404.
- Analyst observation No executable, installer, script payload, or archive download link was identified in the reviewed navigation.
- Analyst observation The only external hosts found in page navigation or resources were google.com, google.co.jp, maps.google.co.jp, and goo.gl.
The two public forms were same-origin Contact Form 7 enquiry and recruitment forms. They requested ordinary contact, address, recruitment, and message fields and posted back to their respective chosei-kai.com paths. They did not request a password, payment card, one-time code, or wallet secret. No form was submitted.
- Public artifact URL https://chosei-kai.com/inquiry
- Public artifact URL https://chosei-kai.com/inquiry_recruit
- Page element The general enquiry form requests name, phonetic name, telephone, address, email confirmation, and a message.
- Page element The recruitment form adds recruitment categories and otherwise uses ordinary contact and message fields.
- Analyst observation Both form actions remained on chosei-kai.com; no password or external credential receiver was present.
Public urlscan records from May 6 through May 8, 2026 preserve a real object-level incident on two exact paths. The pages returned HTTP 200 with the title Sign in - Shaw and displayed a Shaw Webmail interface asking for a Shaw email address and password under a two-factor-authentication message. The saved scan marked phishing against Shaw. The retrieved record demonstrates a historical phishing page, not merely a domain blacklist category; no credential was entered and no malware file or executable payload was recorded.
-
HTTP status
200 - Page element Shaw Webmail branding, Confirm your 2 Factor Authentication, Shaw email, Password, and Sign in.
- File SHA-256 a8759ded511e4bf2b202f0727c798a4bac14268ab3fea0d1d21f88cb2ac7aee1
- Screenshot SHA-256 fff6111d8d372917d079d7ac0449abbf398370e6921607b1fac7ae56ce4f48f0
- Public artifact URL https://urlscan.io/result/019e0538-c6dd-7368-906b-b43a62bf2b18/
- Public artifact URL https://urlscan.io/result/019dfd5a-d461-771d-adf4-9b2acc34446e/
- Analyst observation The urlscan page identified the saved response as phishing against Shaw and recorded response SHA-256 a8759ded511e4bf2b202f0727c798a4bac14268ab3fea0d1d21f88cb2ac7aee1.
The two exact Shaw paths now returned the site's normal HTTP 404 page for desktop, Googlebot, and Gridinsoft profiles. The later reported /00d1/ and /0000/ directories also returned HTTP 404 across those profiles, while direct directory listing for /wp-content/uploads/ returned HTTP 403. The historical phishing content and a credential interface were not reproduced on any of these paths.
-
HTTP status
404 -
Final URL
https://chosei-kai.com/Arress/shaw/index.html -
Final URL
https://chosei-kai.com/Arres/shaw/index.html -
Final URL
https://chosei-kai.com/00d1/ -
Final URL
https://chosei-kai.com/0000/ - Analyst observation Each historical or later reported path returned the same unavailable result for desktop, crawler, and Gridinsoft request profiles.
- Analyst observation The upload-directory root returned HTTP 403 rather than exposing a browsable file index.
The apex and www host resolved to 183.90.240.43 on Xserver infrastructure. The current certificate covered both names and was valid from August 22 through November 20, 2026. Verisign RDAP recorded the domain as active and registered since December 24, 2012, with the same five Xserver nameservers observed in DNS.
- DNS fact chosei-kai.com and www.chosei-kai.com resolved to 183.90.240.43; authoritative nameservers were ns1.xserver.jp through ns5.xserver.jp.
- Certificate fact The current TLS certificate covered chosei-kai.com and www.chosei-kai.com and was valid from 2026-08-22 through 2026-11-20.
- Public artifact URL https://rdap.verisign.com/com/v1/domain/chosei-kai.com
- Analyst observation The exact host and registrable parent are the same apex; www was reviewed as a separate alias.
urlscan returned 25 records: the exact Shaw pages were live in early May, blocked by May 8 through May 11, and returned ordinary 404 pages in June and July; later /00d1/ and /0000/ scans were blocked or unavailable. OTX contained one May 9 bulk phishing-list pulse with a domain-only indicator and 68 URL observations, including the Shaw path already removed by May 13. Wayback indexed successful root and medical-site content from 2013 through 2026, but exact-path archive retrieval was unavailable during this review.
- Public artifact URL https://urlscan.io/domain/chosei-kai.com
- Public artifact URL https://otx.alienvault.com/indicator/domain/chosei-kai.com
- Public artifact URL https://web.archive.org/web/*/chosei-kai.com/
- Analyst observation The exact urlscan records establish the former phishing page and its subsequent removal; the OTX pulse is only a domain indicator without an exact sample or behavior record.
- Analyst observation Wayback CDX exposed successful root and medical-site records beginning in 2013 and continuing through 2026; archive coverage is incomplete.
Current external aggregation retained seven malicious and one suspicious domain blacklist labels outside Gridinsoft, with separate adverse Avira and Norton results. These labels did not name a current URL, credential receiver, file, payload, hash, or execution trace. The public Triage search returned no report; Hybrid Analysis, ANY.RUN, Joe Sandbox, URLQuery, URLhaus API, and ThreatFox API details were unavailable or authentication-limited and were treated as unknown. Recent public OpenPhish, URLhaus, and ThreatFox feeds had no exact match.
- Analyst observation The current aggregate matrix retained alphaMountain.ai, Chong Lua Dao, CyRadar, Fortinet, Lionic, SOCRadar, VIPRE, and Forcepoint ThreatSeeker domain-level results; direct Avira and Norton results were also adverse.
- Analyst observation Bitdefender categorized the site as health and did not return a malicious result.
- Analyst observation No accessible external record beyond the historical Shaw pages supplied a current exact harmful object or behavioral sandbox trace.
- Analyst observation Unavailable or authentication-restricted sources were treated as unknown rather than clean.
The current review did not reproduce the historical Shaw impersonation, an external credential receiver, an unrelated redirect, automatic executable or archive delivery, a malware file, payload, hash, exploit, or harmful execution trace. The current Gridinsoft report also contained no positive first-party behavior signal supporting the active Phishing category. The historical exact-path phishing page remains a confirmed past incident, while current domain blacklist categories are broader reputation context.
- Analyst observation No current phishing page, credential receiver, malware file, payload, hash, exploit, or harmful execution trace was reproduced.
- Analyst observation The fresh Gridinsoft report contained no positive first-party behavior signal supporting the active Phishing classification.
- Analyst observation A concrete historical object and a current domain-wide blacklist category are distinct evidence classes; only the former was directly demonstrated, and it is no longer served.
Scope and limitations
- The verdict applies to the current public apex, www alias, reviewed page sample, public forms, and identified historical paths. Authenticated content, private files, server-side source, databases, logs, mailboxes, administrator state, and future changes were not assessed.
- No contact or recruitment form was submitted, and no credential, personal data, payment data, or one-time code was entered. The historical phishing interface was inspected from preserved public scanner metadata and imagery without interacting with it.
- The preserved historical response and screenshot establish a Shaw-branded email-and-password interface, but they do not prove a submitted credential, victim loss, malware file, payload execution, operator identity, or criminal attribution; none of those stronger claims is made.
- The current WordPress sitemap endpoint returned HTTP 404, so the public-page review used a bounded two-level traversal from live navigation. It requested 79 same-site pages; 78 returned HTTP 200 and one obsolete image path returned HTTP 404.
- Public search, URL-scanner, sandbox, threat-intelligence, feed, and archive indexes are incomplete. Authentication-restricted or unavailable sources were treated as unknown rather than clean.
- A Safe current verdict does not erase the confirmed historical phishing incident or certify future content; it states that the active broad Phishing classification was not supported by reproducible current first-party evidence in the reviewed scope.
Help protect others by sharing this page on social media! The more people who know about chosei-kai.com, the fewer chances they have to deceive someone else. Help others evaluate chosei-kai.com by sharing this page on social media!