What Gridinsoft observed on Geopolitica.site
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260826200311-12e36621
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review supports Safe for geopolitica.site. The claimed historical compromise is plausible and partly corroborated: public urlscan records show the reported destination receiving traffic from multiple unrelated compromised-looking sites during the same August period. That is materially different from a simple blacklist category, but the accessible records do not contain an exact geopolitica.site redirect or the supplied PHP samples. The current deployment is different. Four request profiles reached the expected editorial homepage, www canonicalized to the same root, all six named incident paths returned ordinary 404 responses, representative sitemap pages showed the expected publication, and a fresh Gridinsoft rescan recorded no current positive behavior signal. The remaining CyRadar label is contradictory domain-reputation context and does not identify a current harmful object. Safe describes the current reviewed public deployment and does not deny the plausible historical compromise.
Analyst findings
Review 7 documented observations View evidence
Direct HTTP upgraded once to the canonical HTTPS root, the www host redirected once to the same root, and Windows desktop, Android mobile, Bing crawler, and command-line request profiles each finished at https://geopolitica.site/ with HTTP 200. The reviewed responses served the expected Spanish-language geopolitics publication and did not redirect to an unrelated host or start an automatic download.
-
HTTP status
200 -
Final URL
https://geopolitica.site/ - MIME type text/html; charset=UTF-8
- File SHA-256 932f6c3d5c09d7f8cbf8f711efa5ac128b436c4411a61a535e39f11880212c8a
- Page element Title: INICIO - Web especializada en GEOPOLÍTICA
- Analyst observation The canonical root response was identical through direct HTTPS, the HTTP upgrade, and the www redirect.
Each publicly testable path named in the incident report—_r.php, wplog.php, wplogbak.php, license.php, license_body.php, and ist-dest.txt—returned the site's ordinary HTTP 404 page. A request for .htaccess returned HTTP 403. None served the reported redirect configuration, the IST-HOME-GATE-V7 marker, the claimed redirect domains, PHP source, or a downloadable payload.
-
HTTP status
404 -
Final URL
https://geopolitica.site/_r.php -
Final URL
https://geopolitica.site/wplog.php -
Final URL
https://geopolitica.site/wplogbak.php -
Final URL
https://geopolitica.site/license.php -
Final URL
https://geopolitica.site/license_body.php -
Final URL
https://geopolitica.site/ist-dest.txt - Analyst observation All six named public paths returned HTTP 404; the protected .htaccess path returned HTTP 403.
The current sitemap exposed post and page maps for a conventional editorial WordPress site. The homepage, representative long-form articles, the Geopolitica actual and Pensamiento geopolitico sections, and the privacy page each returned HTTP 200 at the expected same-origin URL. No sampled page contained the reported redirect markers, claimed incident domains, password field, unrelated iframe, executable or archive download reference, or automatic off-domain navigation.
-
HTTP status
200 -
Final URL
https://geopolitica.site/la-situacion-en-ucrania-un-analisis-geopolitico/ -
Final URL
https://geopolitica.site/origenes-de-la-geopolitica/ -
Final URL
https://geopolitica.site/geopolitica-actual/ -
Final URL
https://geopolitica.site/pensamiento-geopolitico/ -
Final URL
https://geopolitica.site/politica-de-privacidad/ - Analyst observation The reviewed public forms were site search and an Infomaniak newsletter subscription; no sampled public page requested a password or payment details.
The apex and www names resolved to 185.125.27.101. Certificate Transparency exposed only geopolitica.site and www.geopolitica.site, and the presented Let's Encrypt certificate covered both names. No mail, ftp, api, or dev host resolved in the bounded DNS check. The exact appealed host is already the registrable parent domain; www is its canonical alias rather than a separate tenant or delegated user-content service.
- DNS fact geopolitica.site A 185.125.27.101
- DNS fact www.geopolitica.site A 185.125.27.101
- Certificate fact Certificate SAN covered geopolitica.site and www.geopolitica.site; validity 2026-07-27 through 2026-10-25.
- Public artifact URL https://api.certspotter.com/
A fresh supported Gridinsoft rescan reached the expected publication title and recorded no current positive behavior signal. Before correction, the retained broad Suspicious Website category identified no current exact malicious geopolitica.site URL, redirect destination, downloaded file, payload, or hash; its current external context contained one CyRadar phishing blacklist label.
- Page element Title: INICIO - Web especializada en GEOPOLÍTICA
- Analyst observation The fresh first-party report contained an empty current positive-signal list.
- Analyst observation The retained broad category did not identify a current exact harmful URL, redirect destination, file, payload, or hash.
Public OSINT separated the alleged historical compromise from current domain reputation. urlscan indexed 29 geopolitica.site records from July 2025 through July 2026, but no post-incident exact-host record or reachable malicious geopolitica.site object. AlienVault OTX returned zero pulses and 36 ordinary exact-domain URLs. Wayback preserved 61 distinct apex pages from August 2020 through May 2026 but no incident-window capture. Search and sandbox indexes exposed no exact sample for the three supplied SHA-256 values.
- Public artifact URL https://urlscan.io/domain/geopolitica.site
- Public artifact URL https://otx.alienvault.com/indicator/domain/geopolitica.site
- Public artifact URL https://web.archive.org/web/20260510170546id_/https://geopolitica.site/
- Analyst observation The reviewed public indexes did not expose a post-remediation harmful URL, a malware sample linked to the exact host, or a public report for any supplied SHA-256.
- Analyst observation Public MalwareBazaar and URLhaus payload lookups required authentication, so their absence from general search was recorded as unverified rather than clean.
The claimed historical destination is not merely a category label: urlscan indexed nine records in which several unrelated starting sites finished on istanbullady.xyz between 14 and 22 August 2026. This corroborates the destination's use in a multi-site redirect campaign during the reported period. The accessible records did not contain geopolitica.site itself, so they support the infrastructure claim but do not independently prove that this exact host delivered the redirect or any of the supplied PHP samples.
- Public artifact URL https://urlscan.io/result/01a029e1-1be4-7289-877d-0e157875f867/
- Public artifact URL https://urlscan.io/result/01a01d8a-548a-7658-b67a-34e7b6a7faf7/
- Public artifact URL https://urlscan.io/result/01a00f76-da0f-778b-bc8d-3514648c1d65/
- Analyst observation The records began at unrelated sites and ended at istanbullady.xyz, consistent with shared compromise redirect infrastructure rather than a geopolitica.site domain-category inference.
Scope and limitations
- The review covered the apex, canonical www alias, four request profiles, six named incident paths, representative sitemap pages, current DNS and TLS, a fresh Gridinsoft rescan, and the recorded public OSINT sources at the review time.
- No actual PHP sample bytes were supplied for execution or code review. The three SHA-256 values and claimed server paths could not be independently tied to geopolitica.site through public indexes, so they were treated as reported historical indicators rather than verified current objects.
- The review did not access the private server filesystem, hosting control panel, WordPress administrator, database, backups, logs, scheduled tasks, deployment pipeline, or endpoint telemetry; it therefore did not independently audit internal remediation or persistence.
- The sitemap sample did not fetch every published article or media file. The reviewed site is an operator-controlled editorial publication rather than a user-content, file-hosting, redirect, or multi-tenant namespace.
- Public search, URL-scan, sandbox, threat-intelligence, and archive indexes are incomplete. Authentication-protected MalwareBazaar, URLhaus, and detailed urlscan records were recorded as unavailable, not clean.
- Conditional, geographic, referrer-based, or time-limited behavior may not appear in a bounded review even though desktop, mobile, crawler, and direct request profiles were compared.
- Safe describes the current observed public deployment and does not guarantee future behavior, private server integrity, or immunity from another compromise.
