What Gridinsoft observed on Convertytmp3.org
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260828000003-25853f55
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The current converter workflow introduces two reproducible risks that are unrelated to the stated media-download function: a third-party notification and tracking script is loaded after valid input, and the first Download action opens a separate advertising redirect chain. These first-party observations support the Suspicious Website category even though current public blacklist and multi-engine results are mostly clean. No specific malware file or payload was identified, so this is not a malware-sample verdict.
Analyst findings
Review 6 documented observations View evidence
The exact reported host is the apex domain, so the exact-host and parent-domain scopes coincide. The www host redirected to the apex. The apex served the active YTMP3 converter from one reviewed network location but redirected another location to a same-site country-restriction page, confirming geography-dependent presentation.
-
HTTP status
200 -
Final URL
https://convertytmp3.org/ -
Final URL
https://convertytmp3.org/restricted/ -
Redirect destination
https://convertytmp3.org/ - Page element Active page title: YTMP3: Free YouTube to MP3 Converter
- Page element Restricted page message: Sorry, this site isn't available in your country.
The current converter accepts a YouTube URL and its first-party JavaScript handles the form locally. After a valid video identifier is submitted, that script appends a third-party script from 9hito.com. The retrieved third-party JavaScript contains browser-notification and push-subscription components in addition to tracking logic.
- Public artifact URL https://convertytmp3.org/js/1787818199/ytmp3.js
- File SHA-256 a20bfb4b32b782e305b5c4d210e82cffab345c1edb870ea2cce8044f98b3ce40
- Public artifact URL https://9hito.com/hid.js
- Analyst observation The current form script adds the 9hito.com script only after a valid YouTube video identifier reaches the conversion path.
- Analyst observation The fetched third-party script included Notification, PushManager, browser-fingerprint, local-storage, and cross-tab coordination code.
The current first-party download handler opens a separate epsiloncloud.org page on the first Download action before navigating the original tab to the generated media URL. Independent live navigation to that advertised page traversed unrelated advertising and tracking hosts, including kocmg.com and trk.catrck.com.
-
Redirect destination
https://epsiloncloud.org/new/ -
Redirect destination
https://kocmg.com/4/10327643 -
Redirect destination
https://trk.catrck.com/ - Analyst observation The extra navigation was unrelated to the requested media file and carried advertising and visitor-tracking context.
The apex resolved to one IPv4 address in Sweden and presented a currently valid Let's Encrypt certificate covering the apex and wildcard namespace. These facts establish reachability and encryption but do not reduce the risk of the observed off-domain advertising flow.
- DNS fact convertytmp3.org A 88.80.22.66
- Certificate fact Let's Encrypt YE1 certificate for convertytmp3.org and *.convertytmp3.org, valid from 2026-08-26T22:49:48Z through 2026-11-24T22:49:47Z
Public exact-host research did not identify a concrete malware sample or malicious exact URL. URLScan returned 16 apex-domain records and none for www, including scans that arrived from ytmp3.ai and yt2mp3.gs. OTX showed zero pulses, eight apex URL observations and two www observations with no Google Safe Browsing matches. Wayback records begin on 2026-06-28 and include multiple revisions of the converter JavaScript. These domain-level results did not determine the verdict.
- Public artifact URL https://urlscan.io/domain/convertytmp3.org
- Public artifact URL https://otx.alienvault.com/indicator/domain/convertytmp3.org
- Public artifact URL https://web.archive.org/web/20260823185941id_/https://convertytmp3.org/
- Analyst observation No reviewed public sandbox, URL-scanner, threat-intelligence, OpenPhish, or archive record supplied a specific malware file, payload, receiver, sample hash, or harmful exact URL on convertytmp3.org.
The investigation reproduced unwanted off-domain advertising and tracking behavior, but it did not obtain or identify a specific malware file, exploit, credential receiver, malicious payload, or sample hash. The verdict is therefore a Suspicious Website classification, not a malware-sample verdict.
- Analyst observation No specific malware object was identified in the reviewed scope.
Scope and limitations
- The active converter and the country-restriction page were both reviewed because the site varies its presentation by visitor location.
- A completed media conversion and the resulting media file were not obtained, so no claim is made about the contents of a specific downloaded MP3 or MP4 file.
- Advertising destinations are dynamic and may differ by visitor location, time, and campaign; the recorded hosts are the destinations observed during this review.
- Public search, sandbox, URL-scanner, threat-intelligence, and archive indexes are incomplete. No exact malicious object found in those sources means not found in the reviewed sources, not proof that every historical or future URL is safe.
Help protect others by sharing this page on social media! The more people who know about convertytmp3.org, the fewer chances they have to deceive someone else. Help others evaluate convertytmp3.org by sharing this page on social media!