What Gridinsoft observed on codeify.cc
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260827223459-66fa16db
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The current exact apex and public application surface did not reproduce phishing, fraud, credential theft, cloaking, an unrelated malicious redirect, or malware delivery. The fresh Gridinsoft-owned scan reached the expected Codeify service with HTTP 200 and recorded no positive behavior signal. The real downloadable installer exactly matched a readable public GitHub source and did not contain a reproduced malicious payload, although its mutable unpinned installation chain should be hardened. Public URL-scan, threat-intelligence, archive, and exact-hash searches did not supply a current harmful object. The prior broad Suspicious Website category is therefore not supported by current reproducible first-party evidence. External Forcepoint and alphaMountain domain labels remain separate contradictory reputation context because they do not expose a current object with observed harmful behavior.
Analyst findings
Review 6 documented observations View evidence
The appealed exact host is the registrable apex codeify.cc, so the exact host and parent domain are the same object; www.codeify.cc did not resolve. The apex returned HTTP 200 without an external redirect and served the expected Codeify AI API marketing page. Desktop, mobile, Googlebot, Bingbot, Gridinsoft-review, and search-referrer requests returned the same 44,545-byte content after removing only Cloudflare's per-request challenge identifier. No user-agent or referrer cloaking was reproduced.
-
HTTP status
200 -
Final URL
https://codeify.cc/ - File SHA-256 de9f47aba43923cb3d1c431e8abd8a9ba16d570baa8d9d37b3fbd9fd377864c2
- Page element Title: Codeify - The models you know and love, cheaper.
- DNS fact codeify.cc resolves through Cloudflare; www.codeify.cc returned no DNS answer during the review.
The public surface presented a same-site account and AI API service. The homepage linked to same-site login, signup, dashboard, docs, and models routes plus Discord and Telegram community links. The login and signup routes returned the same account shell with email and password forms. Unauthenticated API requests returned expected 401 responses, while /v1/models returned an empty JSON object. No copied third-party login, unrelated credential receiver, automatic download, or unrelated redirect was observed. Expected terms, privacy, and refund-policy routes returned 404 and were treated as a transparency limitation rather than malware evidence.
-
HTTP status
200 - Page element Same-site routes: /login, /signup, /dashboard, /docs, /models
- Analyst observation Unauthenticated /v1/responses, /api/auth/me, /api/billing/config, and /api/oauth/clients requests returned HTTP 401 without an off-site redirect.
- Analyst observation The reviewed public account shell did not imitate another brand's login and did not post credentials to an unrelated host.
The site exposes a real 9,351-byte JavaScript installer for its local coding CLI. The downloaded SHA-256 exactly matched scripts/install.cjs in the public whale9820/codeify-cli repository at commit 6e8fa6eda1f4. Static review showed a readable bootstrapper that clones that repository, installs dependencies with lifecycle scripts disabled, builds the CLI, and creates a local command. The installer contained no obfuscated embedded payload, browser or wallet credential collector, unrelated network destination, or persistence routine. The published one-line install method executes current remote code and follows a mutable main branch, which is a supply-chain hardening weakness even though the reviewed current object was not malicious.
-
HTTP status
200 - MIME type application/javascript; charset=utf-8
- File SHA-256 b663a1a05841054947ebd07f7d3280f679bf0d0dbbaac7ba5dcdc65172912c9d
- Public artifact URL https://github.com/whale9820/codeify-cli
- Analyst observation The live installer bytes exactly matched the public repository copy at commit 6e8fa6eda1f4ef06d2aa6a230042b3beb8d7ffe7.
A fresh supported Gridinsoft scan reached the expected Codeify page with HTTP 200, recorded the current title and description, stayed on the same apex host, and recorded no current positive behavior signal. The retained broad Suspicious Website category supplied no exact phishing page, credential receiver, unrelated redirect, malware file, payload, or hash. The reproducible Gridinsoft-owned evidence therefore did not support keeping the broad classification.
-
HTTP status
200 -
Final URL
https://codeify.cc/ - Public artifact URL https://gridinsoft.com/online-virus-scanner/url/codeify-cc
- Analyst observation The fresh first-party report recorded no current positive behavior signal and supplied no exact harmful object for the active broad classification.
Public urlscan search returned 15 codeify.cc records from June 30 through July 23, 2026. The stored pages showed the Codeify service at HTTP 200 or expected unauthenticated API responses at 401, and no stored urlscan malicious verdict. Certificate Transparency linked the earliest codeify.cc certificate to the former service host claude.bypassly.pw; urlscan had seven records for that related host from May 29 through June 22 showing the Codeify or ClaudeCodeify service at HTTP 200 without a stored malicious verdict. OTX reported zero threat pulses for codeify.cc. Wayback returned no codeify.cc or related-host snapshot, so it supplied no preserved harmful object.
- Public artifact URL https://urlscan.io/result/019f8c4b-e7b7-7793-a068-b4ba4c6eb08a/
- Public artifact URL https://otx.alienvault.com/indicator/domain/codeify.cc
- Certificate fact The 2026-06-24 certificate issuance named both codeify.cc and claude.bypassly.pw; later issuances named codeify.cc, *.codeify.cc, and dash.codeify.cc.
- Analyst observation Public exact-host and exact-hash searches found no indexed result in Hybrid Analysis, ANY.RUN, Joe Sandbox, URLhaus, ThreatFox, MalwareBazaar, or PhishTank.
The fresh external matrix contained 55 harmless, one malicious, one suspicious, and 33 undetected results. Forcepoint ThreatSeeker supplied a malicious domain blacklist result, while alphaMountain.ai supplied a suspicious/newly registered domain category. Direct BitDefender had no record, and Avira and Norton reported Safe. None of the accessible adverse records supplied a specific harmful URL, captured response, credential receiver, file, payload, hash, or sandbox behavior trace. A broad domain blacklist category is therefore distinct from a real sample or URL with observed and reproducible malicious behavior.
- Analyst observation External matrix: 55 harmless, one malicious, one suspicious, and 33 undetected results.
- Analyst observation Forcepoint ThreatSeeker and alphaMountain.ai supplied blacklist/category labels rather than an exact object with a public behavioral trace.
- Analyst observation Direct BitDefender returned no record; direct Avira and Norton checks reported Safe.
Scope and limitations
- No customer account was created and no payment, paid model request, voucher, referral, password-reset email, or authenticated dashboard action was performed. The review did not verify model provenance, pricing claims, service availability, billing conduct, or the operator's legal identity.
- The CLI installer and current public repository source were reviewed statically and were not executed. The assessment covers the exact downloaded installer bytes and inspected source, not every dependency's runtime behavior on every platform.
- The site's expected terms, privacy, and refund-policy routes returned 404 during the review. This transparency gap and the mutable installer chain should be remediated, but neither supplied evidence of current phishing, fraud, or malware behavior.
- Public search, URL-scan, sandbox, threat-intelligence, Certificate Transparency, and archive indexes are incomplete. Missing, rate-limited, or authentication-only records were treated as unverified, not clean.
- The verdict describes the current observed public codeify.cc apex, account shell, documented API entry points, and exact installer object. It does not certify future content, private server-side systems, business promises, model-provider authorization, or a later changed installer or repository revision.
Help protect others by sharing this page on social media! The more people who know about codeify.cc, the fewer chances they have to deceive someone else. Help others evaluate codeify.cc by sharing this page on social media!