What Gridinsoft observed on Egidait.pl
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260831215620-8d1c2009
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current first-party review did not reproduce malicious behavior on the public root, www host, the complete sitemap-enumerated surface, or the reviewed same-site scripts. The remaining warnings are domain-level historical or reputation records rather than a current exact malicious object observed in this review.
Analyst findings
Review 6 documented observations View evidence
HTTP requests for the root and www hosts converged on the canonical HTTPS root and served the expected Egida IT website without an unrelated redirect.
-
HTTP status
200 -
Final URL
https://egidait.pl/ - Analyst observation Desktop, mobile, crawler, and command-line request profiles all remained on egidait.pl.
All 28 URLs enumerated by the public WordPress sitemap returned HTTP 200. The reviewed pages remained on the expected site and did not initiate an unrelated redirect or automatic download.
- Public artifact URL https://egidait.pl/wp-sitemap.xml
- Analyst observation 28 of 28 enumerated public URLs returned HTTP 200.
- Analyst observation No unrelated redirect or automatic executable download was observed in the reviewed public surface.
The public HTML and 56 same-site JavaScript resources loaded by the reviewed pages were checked for credential theft, forced navigation, executable delivery, and suspicious obfuscation indicators. No specific malicious payload or active injected redirect was identified.
- File SHA-256 85b9c758b1e66de32daffc877114b3ede1791778c7031df4ca89c4b4aa3ffe80
- MIME type text/html
- Analyst observation Library uses of encoding and dynamic-code tokens were attributable to identified WordPress, jQuery, WPForms, Dropzone, and theme resources rather than an unidentified injected payload.
The material public form is a same-origin service-request form for device and contact details with an optional attachment workflow. No public password, payment-card, seed-phrase, or account-verification collection flow was found in the reviewed pages.
-
HTTP status
200 -
Final URL
https://egidait.pl/zgloszenie-serwisowe-pgnig/ - Page element Same-origin WPForms service-request form with device, contact, problem-description, and attachment fields.
Three public recursive resolvers returned the same address for the root and www hosts, and the HTTPS certificate covered both names.
- DNS fact 1.1.1.1, 8.8.8.8, and 9.9.9.9 returned 77.55.158.200 for egidait.pl and www.egidait.pl.
- Certificate fact Certificate subject egidait.pl; SANs egidait.pl and www.egidait.pl; valid through 2026-09-30T00:00:00Z.
Public archives preserve ordinary corporate root and service pages from January through June 2026 but contain no August capture of the incident window. Public URL-scanner metadata records root scans on August 14, 15, and 27 that ended at the same HTTPS root with HTTP 200, but the detailed scan artifacts were not publicly retrievable for this review.
- Public artifact URL https://web.archive.org/web/20260609060600id_/https://egidait.pl/
- Analyst observation The archive index returned no capture from 2026-08-01 through 2026-08-31.
- Analyst observation The URL-scanner search exposed root-level scan metadata but no publicly retrievable exact malicious URL, payload, or file hash.
Scope and limitations
- The result applies to the current public root and www deployment, the 28 sitemap-enumerated URLs, and resources reviewed at the recorded time.
- No August archive captured the admitted incident window, and restricted detailed URL-scanner artifacts could not be used to reconstruct the historical compromise.
- The review does not certify private server logs, mailboxes, hosting control panels, future content, or unlinked paths that were not discoverable from the current public surface.
Help protect others by sharing this page on social media! The more people who know about egidait.pl, the fewer chances they have to deceive someone else. Help others evaluate egidait.pl by sharing this page on social media!