What Gridinsoft observed on coffergroup.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260827234704-2a86cb79
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review supports Safe for coffergroup.com. The historical compromise was genuine: during the reported July window, the exact root page requested an unrelated external JavaScript response and contacted Polygon RPC services, and OTX subsequently grouped the domain under Compromised by ClickFix. That evidence is an exact behavior trace rather than a blacklist inference, although it does not preserve an executable payload. The current state is materially different. All 29 published HTML URLs and 21 same-origin scripts returned expected site content without the historical infrastructure or loader markers; six fresh request profiles and three later public browser scans likewise reproduced no malicious redirect, credential-theft flow, remote-command instruction, payload, or automatic download. Remaining adverse vendor and threat-intelligence results are broad domain labels and do not demonstrate current harmful behavior. Safe describes the public deployment reviewed now and does not erase the confirmed July compromise.
Analyst findings
Review 6 documented observations View evidence
A public browser scan from 2026-07-23, within the reported incident window, recorded the exact coffergroup.com root page requesting a 388-byte external JavaScript response from https://authorization-id-browser.info/api.php. The same page session also contacted Polygon RPC services. The external response had SHA-256 a981272f96749b77b62ad0bf1c0db0a08b65e00cccee2dd8f86535047dca889c. OTX subsequently listed coffergroup.com in a pulse named Compromised by ClickFix. This is a preserved behavior trace tied to the root page, not merely a blacklist category. The accessible record does not preserve an executable payload or prove that one was delivered in that session.
- Public artifact URL https://urlscan.io/result/019f8fc5-d47d-703a-a35a-050bb21b7711/
- Public artifact URL https://otx.alienvault.com/indicator/domain/coffergroup.com
-
Final URL
https://authorization-id-browser.info/api.php - File SHA-256 a981272f96749b77b62ad0bf1c0db0a08b65e00cccee2dd8f86535047dca889c
- Analyst observation The July 23 browser trace attributes the external script request to https://coffergroup.com/ and records a contemporaneous Polygon RPC request in the same session.
The current WordPress API and sitemap exposed 29 unique published HTML URLs: 22 pages and seven posts. Every URL returned HTTP 200 on coffergroup.com. The complete reviewed HTML and its 21 same-origin JavaScript resources contained no reference to authorization-id-browser.info, the historical Polygon RPC services, ClickFix, PowerShell, clipboard instructions, an automatic executable or archive download, or an unrelated final redirect.
-
HTTP status
200 -
Final URL
https://coffergroup.com/wp-sitemap.xml - Analyst observation All 29 unique published HTML URLs returned HTTP 200 at coffergroup.com.
- Analyst observation Twenty-one same-origin JavaScript resources were retrieved; neither the HTML nor those scripts referenced the historical external script host, the historical RPC endpoints, ClickFix, PowerShell, or clipboard instructions.
- Analyst observation No reviewed page exposed an executable or archive download link, and no reviewed page redirected to an unrelated final host.
The current public site presents ordinary same-origin Gravity Forms contact forms. The dedicated contact page accepts a name, email address, inquiry type, message, and an optional business-document upload. Other reviewed pages reuse a same-origin name, email, subject, and message form. No password, one-time code, payment-card, wallet, or remote-command field was present, and no form or upload was submitted during the review.
-
HTTP status
200 -
Final URL
https://coffergroup.com/contact-us/ - Page element Same-origin Gravity Forms contact forms request ordinary contact details and messages; the contact page also exposes a documented business-file upload field.
- Analyst observation No reviewed form requested a password, one-time code, payment-card value, wallet secret, or remote-command execution.
Fresh desktop, mobile, Google crawler, Bing crawler, Gridinsoft, and Google-referrer requests all returned HTTP 200 at the same HTTPS root with the expected Coffer Group business page. HTTP and www requests converged on https://coffergroup.com/. A fresh supported Gridinsoft report also reached the expected page with HTTP 200, showed the ordinary WordPress and business-content resources, and recorded no current positive behavior signal or exact harmful object.
-
HTTP status
200 -
Final URL
https://coffergroup.com/ - MIME type text/html; charset=UTF-8
- Public artifact URL https://gridinsoft.com/online-virus-scanner/url/coffergroup-com
- Analyst observation Six fresh request profiles reached the expected Coffer Group page and contained none of the historical script host, RPC services, or ClickFix markers.
Public browser records establish a time-bounded change. The July 23 scan included the external authorization-id-browser.info script and Polygon RPC traffic. Scans from August 6, August 7, and August 9 loaded the expected coffergroup.com, WP Engine, WordPress analytics, Google, and LinkedIn resources without the historical external script host or RPC services; urlscan recorded no adverse verdict for those later scans.
- Public artifact URL https://urlscan.io/result/019fd84e-7858-7630-a051-b501c6a72677/
- Public artifact URL https://urlscan.io/result/019fdc0e-1e78-7039-b864-169faa4326c6/
- Public artifact URL https://urlscan.io/result/019fe87e-aba0-73ba-9ac1-a555824b4506/
- Analyst observation Three later public browser scans omitted both authorization-id-browser.info and the Polygon RPC traffic seen during the July incident.
OTX retains one domain-level ClickFix pulse dated 2026-07-26, matching the reported incident window. The fresh external snapshot retained CRDF and CyRadar malicious or malware labels and one alphaMountain.ai suspicious label, while 57 engines reported harmless. Public exact-domain searches found no additional result in Hybrid Analysis, ANY.RUN, Triage, Joe Sandbox, URLQuery, URLhaus, or ThreatFox. Wayback exposed ordinary 2026 captures through May but no capture for the July incident window or the later August state. The remaining adverse records are broad domain categories and do not identify a currently reachable harmful path, response, file, payload, or hash.
- Public artifact URL https://otx.alienvault.com/indicator/domain/coffergroup.com
- Public artifact URL https://web.archive.org/web/*/https://coffergroup.com/
- Analyst observation The fresh external snapshot contained 57 harmless results, two malicious results, one suspicious result, and 30 undetected results; the adverse engines supplied domain blacklist labels rather than a current behavior trace.
- Analyst observation Public sandbox and threat-intelligence indexes beyond urlscan and OTX supplied no additional exact-domain result; unavailable or authentication-only sources were treated as unverified, not clean.
Scope and limitations
- The review covered coffergroup.com, its current sitemap and WordPress-published pages, the exact root behavior, public forms without submission, and publicly indexed history at the recorded time; it does not deny the confirmed July compromise.
- The review did not access the private server filesystem, database, WordPress administrator, hosting account, source repository, deployment pipeline, backups, endpoint telemetry, or server logs, so internal remediation and persistence checks were not independently audited.
- The July browser trace preserved the injected external JavaScript request and related RPC traffic, but the external JavaScript body was not available for independent content inspection and no executable payload was preserved. The review therefore does not claim that the scan session downloaded an executable or displayed a complete ClickFix lure.
- No contact, file-upload, client-portal, administrative, or authenticated form was submitted.
- Public search, URL-scan, sandbox, threat-intelligence, and archive indexes are incomplete. Authentication-required or unavailable sources were treated as unverified, not clean.
- Safe describes the current observed public security behavior and does not guarantee future content, infrastructure integrity, private services, or immunity from another compromise.
Help protect others by sharing this page on social media! The more people who know about coffergroup.com, the fewer chances they have to deceive someone else. Help others evaluate coffergroup.com by sharing this page on social media!