What Gridinsoft observed on Driveformohawk.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260821041619-2438643d
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review supports a Safe classification for driveformohawk.com. A fresh Gridinsoft scan retained Suspicious Website from a stored June 2026 signature but exposed no positive first-party signal or exact malicious object. All 72 HTML URLs enumerated from the current sitemaps returned HTTP 200 and presented coherent Mohawk Industries recruitment, job, and driver-story content without a concealed redirect, credential or payment collector, injected spam topic, executable or archive download, unrelated frame, exploit, or malicious loader. Mohawk Industries' careers site directly links its transportation candidates to driveformohawk.com, and current job pages route applications to a Mohawk-specific HTTPS tenant at intelliapp.driverapponline.com. The current first-party evidence therefore contradicts the existing domain-wide warning. External provider labels remain separate contradictory context and were not used to determine the verdict.
Analyst findings
Review 8 documented observations View evidence
A fresh Gridinsoft rescan retained Suspicious Website from an active domain signature dated 2026-06-01. The current raw report contained no positive signals, named no malicious URL or file, and separately calculated a trust score of 100. Its warning tags were attributable to external provider reputation rather than a reproducible current Gridinsoft-owned payload.
- Page element checker.category: Suspicious Website; signature: susp_website; signature datetime: 2026-06-01T13:00:12.653000
- Analyst observation The fresh raw report recorded positive_signals as an empty array.
- Analyst observation No exact malicious object, payload URL, executable hash, redirect destination, credential collector, or exploit was identified by the current first-party report.
The HTTPS root returned HTTP 200 and rendered a Mohawk Industries driver-recruiting site. Desktop, Googlebot, Facebook crawler, and curl user agents each received a 146,011-byte page with the same title, navigation, recruitment content, and destinations. The desktop and Googlebot sources became byte-identical after normalizing only request-time spacing identifiers and the generated stylesheet counter.
-
HTTP status
200 -
Final URL
https://driveformohawk.com/ - Page element Drive for Mohawk Industries - Mohawk Driver Hiring
- File SHA-256 156ab79a6680eb1ec0c81a69a332a4a221a7a9403bbab75c89418f65a7de9ae9
- Analyst observation The recorded digest is the normalized desktop/Googlebot HTML digest; the only raw differences were generated spacing element IDs and a same-origin stylesheet version counter.
The current sitemap exposed 72 unique HTML URLs: the root, three principal navigation pages, a driver-stories archive and articles, a job archive, and 29 current job pages. Every enumerated URL returned HTTP 200 without an unrelated redirect. Review of all 72 responses found no meta refresh, credential or payment form, executable or archive download, unrelated embedded frame, injected search-spam topic, or obfuscated loader. The only form on the reviewed domain was the same-origin site search; one article contained an ordinary YouTube embed.
- Public artifact URL https://driveformohawk.com/page-sitemap.xml
- Public artifact URL https://driveformohawk.com/job-sitemap.xml
- Page element 72 reviewed sitemap HTML URLs; 72 HTTP 200 responses; 0 fetch errors
- Page element <form method="get" class="search-form" action="https://driveformohawk.com/">
- Analyst observation The atob() token common to the pages was traced to Slider Revolution code that decodes a configured image source; it was not a concealed redirect or payload loader.
The site exposed a coherent WordPress 7.1 deployment. Public REST collections returned 42 pages, no posts in the default post collection, and 29 current job objects; public user enumeration was denied with HTTP 401. Visible current asset versions included Contact Form 7 6.1.7, MonsterInsights 11.1.3, WPBakery 9.0.1, and the site theme and presentation components. These version strings document the served deployment but were not treated as proof of the complete private plugin inventory.
- Public artifact URL https://driveformohawk.com/wp-json/
- Page element WordPress 7.1
- Analyst observation Public REST review found 42 page objects and 29 current job objects; no unrelated or injected topic was identified in their public titles, links, or rendered page content.
-
HTTP status
401
A current job page displayed the vacancy title and two Apply Now links to the Mohawk tenant at intelliapp.driverapponline.com with the same numeric job identifier. The external destination opened over HTTPS as Online Application Form - Mohawk Industries, Inc. No application was submitted. Across the reviewed domain, applicant data was not collected by a concealed same-origin form.
- Public artifact URL https://intelliapp.driverapponline.com/
- Page element Online Application Form - Mohawk Industries, Inc.
- Page element Application path: /c/mohawk; active_job_id: 124896
- Analyst observation The external application route was opened without entering data or submitting the application form.
Mohawk Industries' careers site on mohawkind.com described its transportation positions and linked its Explore Positions control directly to www.driveformohawk.com. The reviewed site reciprocally linked to Mohawk Industries legal, privacy, benefits, careers, LinkedIn, Facebook, and YouTube properties and used mohawkind.com recruiting contact details. This current cross-linking supports the site's stated corporate recruitment purpose.
- Public artifact URL https://careers.mohawkind.com/
- Page element TRANSPORTATION POSITIONS — Explore Positions — www.driveformohawk.com
- Public artifact URL https://www.linkedin.com/company/mohawk-industries/life/driveformohawk
- Analyst observation The independent verdict relied on current behavior and attribution, not merely on the displayed brand or domain age.
The apex resolved to 69.167.168.136 and used Mohawk-branded authoritative nameservers ns1.mohawkind.info, ns2.mohawkind.info, and ns3.mohawkind.info. The current Let's Encrypt certificate covered driveformohawk.com and www.driveformohawk.com and was valid from 2026-08-13 through 2026-11-11. Plain HTTP resolved to the same-site HTTPS root in the fresh Gridinsoft report.
- DNS fact A record observed: 69.167.168.136.
- DNS fact Authoritative nameservers observed: ns1.mohawkind.info, ns2.mohawkind.info, ns3.mohawkind.info.
- Certificate fact Certificate subject CN=www.driveformohawk.com; issuer Let's Encrypt YR1; SAN driveformohawk.com and www.driveformohawk.com.
- Certificate fact Certificate validity: 2026-08-13T22:46:25Z through 2026-11-11T22:46:24Z.
The current review did not reproduce phishing impersonation, an on-domain credential or payment collector, an unrelated redirect, a malicious or unwanted file, an executable download, an exploit, injected spam, a concealed loader, or a specific malicious payload attributable to the current deployment. Public HTTP review cannot establish every private server file or historical condition, and the review did not treat the requester's private malware-scan claims as independent evidence.
- Analyst observation No reproducible current Gridinsoft-owned phishing or malware artifact was found in the accessible published scope.
- Analyst observation Private scanner results, server filesystem state, and unpublished routes were outside the independently observable scope and were not used for the verdict.
Scope and limitations
- The review covered the public root, every HTML URL in the two current sitemaps, public WordPress REST collections, navigation, redirects, linked application destinations, DNS, and TLS; it did not audit the private server filesystem or database.
- The external Mohawk application destination was opened and attributed but no application fields were completed or submitted.
- Visible WordPress and plugin version strings describe served assets but do not prove the complete private plugin inventory or every server-side patch.
- The public review cannot prove that no unpublished route or private file exists anywhere on the server and does not establish the site's historical state before the observed review window.
- The Safe verdict describes the reviewed current deployment and does not guarantee future content or certify every third-party resource.
- External provider labels were recorded separately as contradictory context and did not control the independent verdict.
Help protect others by sharing this page on social media! The more people who know about driveformohawk.com, the fewer chances they have to deceive someone else. Help others evaluate driveformohawk.com by sharing this page on social media!