What Gridinsoft observed on Codernav.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260828233940-191021c9
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only โ not used for this decision
The independent Gridinsoft review supports retaining Suspicious Website for codernav.com. The root did not reproduce an unrelated automatic redirect, and no specific malware sample, payload, URL, or hash was proven. However, the site exposes a large encoded outbound-navigation namespace and an operator-authored resource tutorial that instructs users to use obscured, password-protected archives and bypass a browser unsafe-download warning. These first-party conditions justify caution without overstating the evidence as proof of a particular malware payload. External vendor labels were not used for this verdict.
Analyst findings
Review 6 documented observations View evidence
The current Gridinsoft report reached the expected Chinese-language link-directory deployment and retained Suspicious Website. The root stayed on codernav.com, and the report did not name an exact malicious URL, file, payload, hash, credential receiver, or exploit. The report contained no positive behavior signal, so the independent decision follows from the separately reproduced navigation and download-guidance surface rather than from an unspecified malware inference.
- Page element Current title: ๅผๅ่ ๅฏผ่ช - ้ไธ่ฑๅผ๏ผๅฏ็ผ็ผๅฝ็ฃใ
-
Final URL
https://codernav.com/ - Analyst observation The current report retained Suspicious Website and contained no positive behavior signal or named exact harmful object.
Direct desktop, mobile, and scanner-profile requests to the apex, www, and start hosts resolved to the same server but received HTTP 403 anti-automation responses. The apex response stayed on the requested host and contained only a script that navigated back to the same root. The live robots file and sitemap remained publicly accessible with HTTP 200.
-
HTTP status
403 -
Final URL
https://codernav.com/ - Page element The 403 response used a same-origin browser navigation back to the root and did not expose an unrelated redirect destination.
- Analyst observation robots.txt and sitemap.xml returned HTTP 200 while the reviewed HTML routes and the outbound-navigation route were blocked by the same anti-automation boundary.
The live sitemap enumerated 39,356 same-host URLs, including 5,382 site-entry pages, 7,012 numeric article pages, 26,724 tag pages, and account or favorites surfaces. A preserved 2026 root page contained 168 links handled through the same-origin /go/ route with encoded third-party destinations, while the live robots policy excluded /go/ from crawling.
-
HTTP status
200 - Page element Live sitemap counts: 39,356 total URLs; 5,382 /sites/ pages; 7,012 numeric article pages; 26,724 tag pages.
- Page element The preserved 2026 root page contained 168 navigation links whose third-party destinations were encoded and handled by the same-origin /go/ route.
- Page element The live robots policy disallowed /go/.
A May 2026 public snapshot preserved an operator-authored tutorial that pointed users to alist.codernav.com for more than 10 TB of resources. It said archives used multiple encryption layers to prevent reports and removal, instructed users to rename files with unexpected extensions to ZIP, supplied the archive password, and advised bypassing an Edge unsafe-download warning by using another browser or keeping the download. The exact tutorial URL remains listed in the current live sitemap.
- Public artifact URL https://codernav.com/7755.html
- Page element The tutorial identified alist.codernav.com as a resource repository with more than 10 TB of content.
- Page element The tutorial instructed users to download archives locally, rename unexpected file extensions to ZIP, and use the supplied password after describing multiple encryption layers intended to prevent reports and removal.
- Page element For an Edge unsafe-download warning, the tutorial advised using another browser or selecting the option to keep the download.
- Analyst observation The live sitemap still listed https://codernav.com/7755.html with its recorded 2024-10-13 last-modified value.
The referenced alist resource host currently resolved to the same 119.91.2.76 server as the apex. Its HTTPS endpoint presented the apex certificate, whose names covered only codernav.com and www.codernav.com, so hostname validation failed for alist.codernav.com. HTTP and a certificate-ignoring HTTPS request both returned the same anti-automation 403 boundary; no resource archive was downloaded or executed.
- DNS fact codernav.com, www.codernav.com, start.codernav.com, and alist.codernav.com resolved to 119.91.2.76 during the review.
- Certificate fact The presented certificate covered codernav.com and www.codernav.com but did not cover alist.codernav.com.
-
HTTP status
403 - Analyst observation No file listing, archive, executable, or payload was retrieved from the resource host.
The review identified security-sensitive download guidance and a large encoded outbound-navigation surface, but it did not identify or execute a specific malware file, payload, hash, credential-theft page, or exploit served by codernav.com. The retained category is therefore Suspicious Website, not a claim that a particular current sample was proven malicious.
- Analyst observation No exact malware file, payload, URL, or hash was identified in the reviewed scope.
- Analyst observation No unrelated automatic root redirect or credential receiver was reproduced.
Scope and limitations
- The site returned anti-automation HTTP 403 responses for the reviewed HTML and outbound-navigation routes, so the exact current destination behavior could not be exercised directly from the review network.
- No exact resource file, archive URL, or hash was supplied with the appeal. No archive, executable, or other payload was downloaded or executed.
- The live sitemap and encoded outbound-link namespace are too large and changeable for exhaustive destination review; a specific disputed URL or file requires object-level analysis.
- The historical tutorial content was verified from a May 2026 public snapshot and its continued presence in the live sitemap, but the origin page body could not be retrieved directly through the current anti-automation boundary.
- Private server files, authenticated accounts, administrative tools, upload workflows, and server logs were not accessed. Public search, scanner, threat-intelligence, and archive indexes are incomplete.
Help protect others by sharing this page on social media! The more people who know about codernav.com, the fewer chances they have to deceive someone else. Help others evaluate codernav.com by sharing this page on social media!