What Gridinsoft observed on hikari3.ch
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20261022020614-5b6b92e8
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- User-content imageboard
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The reviewed pages do not reproduce phishing or malware. The whole-domain assessment remains inconclusive because changing user posts, uploads and outbound destinations were not assessed sufficiently for a universal safety conclusion. Domain blacklist categories must be distinguished from an observed harmful URL or file; no such object was established here.
Analyst findings
Review 3 documented observations View evidence
Both root addresses returned an anonymous imageboard. The rules, FAQ, posting form, site-development thread, two board catalogs and selected scripts were reviewed. The posting form submits to the same site; the selected scripts retrieve posts and previews from same-site endpoints. No credential-stealing page, forced malicious download or specific malicious file was identified in these responses. Imageboard accurately describes the service and does not itself establish phishing or malware.
- Public artifact URL https://hikari3.ch/
- Public artifact URL https://www.hikari3.ch/
- Public artifact URL https://hikari3.ch/rules
- Public artifact URL https://hikari3.ch/faq
- Public artifact URL https://hikari3.ch/submit
- Public artifact URL https://hikari3.ch/h3/thread/849
- Public artifact URL https://hikari3.ch/t/catalog
- Public artifact URL https://hikari3.ch/en/catalog
- Public artifact URL https://hikari3.ch/js/home.js
- Public artifact URL https://hikari3.ch/js/footer.js
The reviewed apex is hikari3.ch, so the exact host and registrable parent are the same; www.hikari3.ch was checked separately. Public indexes show forum pages and a project GitHub organization with a verified domain. Existing URLscan search metadata lists root-page observations on 2026-10-10 and 2026-10-22 with HTTP 200; the accessible 30-day search returned no separate www record. OTX returned zero pulses and zero malware entries for both targets. Exact-name searches of public ANY.RUN, Triage, URLhaus and ThreatFox indexes yielded no matching harmful object. These bounded results do not establish universal absence of abuse or certify downloaded files.
- Public artifact URL https://github.com/hikari3-ch
- Public artifact URL https://urlscan.io/result/01a127c9-2184-721d-ad7a-7995860d2f34/
- Public artifact URL https://urlscan.io/result/01a1610a-3ccb-7453-a8f0-bc4b7f448913/
- Public artifact URL https://otx.alienvault.com/indicator/domain/hikari3.ch
- Public artifact URL https://otx.alienvault.com/indicator/hostname/www.hikari3.ch
Wayback root captures from 2025-01-04 and 2026-01-03 were read. Both describe an anonymous discussion imageboard with user posts and media. This supports continuity of the site purpose, but does not establish the safety of all historical uploads, links or intervening responses. An earlier compromise was not established by these captures.
- Public artifact URL https://web.archive.org/web/20250104005124/https://hikari3.ch/
- Public artifact URL https://web.archive.org/web/20260103012609/https://hikari3.ch/
Scope and limitations
- No post, credentials or CAPTCHA answer was submitted; uploads were not executed. This was a review of selected public responses, not a complete browser or application security audit. Private administration, every user object and conditional responses were outside the tested scope.
- Historical captures and indexed observations are samples. Zero entries in the checked intelligence sections are not proof of safety. Other subdomains, including a separate upload service, are outside this domain decision.
Help protect others by sharing this page on social media! The more people who know about hikari3.ch, the fewer chances they have to deceive someone else. Help others evaluate hikari3.ch by sharing this page on social media!