What Gridinsoft observed on Dra.com.ve
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260824005900-81d1bb14
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review supports Safe for dra.com.ve and its canonical www host. The historical incident was genuine: the exact ds5.txt URL served a functional Perl IRC bot from at least 2026-07-29 through public captures on 2026-08-15. It is no longer served. Current checks across four request profiles returned the normal HTTP 404 page at that exact path, and a complete crawl of all 128 current sitemap URLs found no malware delivery, unrelated redirect, injected page, credential theft, automatic download, or other exact harmful object. A fresh Gridinsoft rescan reached the live site but retained only the broad 2026-07-30 domain signature with positive_signals=[] and no current object-level basis. Current external blacklist labels are contradictory context, not evidence that the removed sample remains active. The broad Gridinsoft category therefore conflicts with the reproducible current state and should be removed. The documented hardening gaps warrant remediation but do not establish current malicious behavior. Safe describes the reviewed public deployment now, not its historical state or a guarantee against future compromise.
Analyst findings
Review 7 documented observations View evidence
The exact previously reported object returned HTTP 404 with the normal D’Empaire Page not found HTML for desktop, mobile, Google crawler, and Gridinsoft review request profiles. All four responses had the same final URL and content, and none returned the former text file, a download, or an unrelated redirect.
-
HTTP status
404 -
Final URL
https://www.dra.com.ve/wp-content/languages/plugins/ds5.txt - MIME type text/html; charset=UTF-8
- Page element All four profiles returned the title Page not found : D’Empaire and the visible text Error 404, page not found.
A bounded crawl reviewed all 128 unique URLs in the current page, lawyer, and practice-area sitemaps. All final URLs remained on www.dra.com.ve; 127 returned HTTP 200 and the obsolete splash route returned the same normal HTTP 404 page. No reviewed page referenced ds5.txt, an executable or archive download, an unrelated final destination, an injected iframe, or a credential-collection flow.
- Analyst observation The current sitemap set contained 128 unique same-origin URLs; 127 returned HTTP 200 and one obsolete splash route returned HTTP 404.
- Analyst observation Every reviewed final URL used www.dra.com.ve, and no reviewed page referenced an executable, installer, archive, script package, mobile package, or ds5.txt download.
- Page element The only iframe found was the expected Google reCAPTCHA fallback on the two same-origin contact pages; their forms posted to same-origin contact anchors.
- Analyst observation The reviewed external content hosts were limited to cdn.jsdelivr.net, Font Awesome, Google, Google Tag Manager, LinkedIn, gmpg.org, and the site itself.
The apex endpoint redirected once to the canonical https://www.dra.com.ve/ page, which returned HTTP 200. Cloudflare, Google, and Quad9 resolvers all returned the same address for the apex and www host. The active certificate covered both names and was valid through 2026-11-12.
-
HTTP status
200 -
Redirect destination
https://www.dra.com.ve/ - DNS fact Cloudflare, Google, and Quad9 each resolved dra.com.ve and www.dra.com.ve to 216.70.101.123 during the review.
- Certificate fact The Let’s Encrypt certificate covered dra.com.ve and www.dra.com.ve and was valid from 2026-08-14 through 2026-11-12.
A fresh supported Gridinsoft rescan reached the current site with HTTP 200 but retained the broad Suspicious Website signature dated 2026-07-30. The current report exposed an empty positive-signal list and named no exact current malicious URL, file, payload, redirect destination, exploit, command, or hash supporting that domain-wide category.
-
HTTP status
200 - Analyst observation The fresh report returned positive_signals=[] for the current deployment.
- Analyst observation The retained domain signature was dated 2026-07-30 and contained no exact current malicious object or behavior trace.
Historical public evidence confirmed that the reported path was a real malicious object rather than a false alarm. Public urlscan records returned HTTP 200 and text/plain for this exact URL from 2026-07-29 through 2026-08-06. A Wayback capture from 2026-08-15 preserved a Perl ShellBOT that connected to an IRC command channel and implemented remote shell, download, port-scan, reverse-connection, mail, and UDP-flood functions. Later urlscan records on 2026-08-18 and 2026-08-21 returned HTTP 404.
- Public artifact URL https://urlscan.io/result/019fae2b-4fcd-753c-9b67-8f8f33e81294/
- Public artifact URL https://urlscan.io/result/019fd58e-bcbe-750f-bb3a-c5ea6a891a5f/
- Public artifact URL https://urlscan.io/result/01a0157c-ea57-7499-be36-bf6116ad1c00/
- Analyst observation The archived 2026-08-15 response was 32,438 bytes of text/plain Perl source identifying itself as ShellBOT and exposing IRC-controlled remote administration and attack functions.
- Analyst observation The historical exact-object record and the current 404 state establish a time-bounded compromise and removal; they do not establish current domain-wide malicious behavior.
OTX listed two URLHaus-derived pulses for the exact www hostname and identified the ds5.txt URL, while its registrable-domain entry had no pulse. Public malware-feed indexes identified the preserved file as botnet malware. Separately, the current external domain snapshot still contained malicious or suspicious blacklist labels, but it named no currently reachable harmful path or current behavior trace. Public web indexes consistently associated the root domain with the long-established D’Empaire law firm.
- Public artifact URL https://otx.alienvault.com/indicator/hostname/www.dra.com.ve
- Public artifact URL https://otx.alienvault.com/indicator/domain/dra.com.ve
- Analyst observation The supplied VirusTotal URL identifier corresponds to http://www.dra.com.ve/, not to the historical ds5.txt object.
- Analyst observation Current external domain results remained blacklist classifications and did not reproduce the removed exact object; external results were context only.
- Analyst observation Independent public legal directories and professional profiles consistently identified www.dra.com.ve as the website of D’Empaire, a Venezuelan law firm founded in 1972.
The current root response did not include HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, or Permissions-Policy headers, and plesk.dra.com.ve exposed the hosting control-panel login. These are current attack-surface and hardening concerns after a recent compromise, but no exploit, unauthorized login, injected content, or malicious response was reproduced.
- Page element The reviewed root response exposed server and platform headers but none of the listed browser security-policy headers.
-
Final URL
https://plesk.dra.com.ve:443/login.php - Analyst observation The control-panel endpoint presented the expected Plesk login and was not authenticated, penetration-tested, or treated as evidence of compromise.
Scope and limitations
- The verdict applies to the publicly reachable dra.com.ve, www.dra.com.ve, and exact reported ds5.txt path observed at the recorded time; it does not erase or contradict the confirmed historical compromise.
- The review did not access the private server filesystem, database, Plesk account, WordPress administrator, source repository, deployment pipeline, backups, endpoint telemetry, or server logs, so the requester’s internal remediation measures were not independently audited.
- The archived Perl file was reviewed statically and was not executed or allowed to contact its configured infrastructure.
- No contact form was submitted and no administrative or authenticated function was exercised.
- Public search, URL-scanning, sandbox, threat-intelligence, certificate, and archive indexes are incomplete. Authentication-gated API results that could not be retrieved were treated as unverified, not clean.
- The public Plesk login was not penetration-tested. Its presence and the missing browser security-policy headers are hardening concerns, not proof of current compromise.
- Safe describes observed current security behavior and does not guarantee future content, infrastructure integrity, or immunity from another compromise.
Help protect others by sharing this page on social media! The more people who know about dra.com.ve, the fewer chances they have to deceive someone else. Help others evaluate dra.com.ve by sharing this page on social media!