What Gridinsoft observed on Hubeu.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260821033525-8607fb4b
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent review did not reproduce phishing, malware delivery, an impersonated credential flow, an unrelated redirect, or a specific malicious payload on the accessible Hubeu operator pages or the exact linked survey. The displayed operator identity also matched the Finnish public register. However, hubeu.com is a hosting platform with a wildcard, user-controlled subdomain namespace; the five publicly listed community deployments were unavailable during the review, and arbitrary tenant content cannot be exhaustively assessed. The evidence contradicts an unconditional domain-wide Phishing conclusion, but it is insufficient for a domain-wide Safe verdict. The appropriate current Gridinsoft category is the narrower Suspicious Website classification, with exact tenant or destination review required.
Analyst findings
Review 7 documented observations View evidence
The HTTPS homepage returned HTTP 200 and displayed the expected Hubeu European cloud-hosting service. Desktop, mobile, crawler, and Gridinsoft user-agent requests returned the same 26,812-byte HTML body and the same SHA-256 digest without an unrelated redirect.
-
HTTP status
200 -
Final URL
https://hubeu.com/ - Page element Hubeu — The European Multi-Cloud for Developers
- File SHA-256 4627ebf0a34f0d476268882c23b6fb45343160851619ef0e5a5b881ae32267ad
- Analyst observation Four reviewed user-agent profiles produced the same current homepage body.
The review covered fourteen linked public routes, including pricing, support, documentation, legal pages, sign-in, and sign-up. Navigation stayed within the Hubeu service except for disclosed community demonstrations, source repositories, mail links, and the Hubeu survey. Login used the Hubeu-controlled v2-supabase.hubeu.com authentication service, sign-up used the Hubeu-controlled v2-api.hubeu.com service, and support used mailer-service-v2.hubeu.com. No concealed unrelated credential destination, iframe, meta refresh, or automatic executable or archive download was observed.
- Public artifact URL https://hubeu.com/login
- Public artifact URL https://hubeu.com/signup
- Public artifact URL https://hubeu.com/support
- Page element https://v2-supabase.hubeu.com
- Page element https://v2-api.hubeu.com/api/v1/auth/signup
- Page element https://mailer-service-v2.hubeu.com/api/v1/send/contact
- Analyst observation No automatic executable or archive download link was identified in the reviewed public routes.
The exact survey linked by the operator site returned HTTP 200 and contained eight developer and hosting-preference questions followed by first-name and email collection for early access. The form identified itself as an Hubeu survey, used the same Hubeu service context, had no external redirect, and did not request a password, payment detail, recovery phrase, or financial-account credential.
-
HTTP status
200 -
Final URL
https://survey.hubeu.com/s/cmgeoq1lo0006k001ypiw5ina - Page element Help us build European cloud platform. This survey has 8 quick questions and takes less than 2 minutes.
- Page element Fill in your information to get free 6 months subscription!
- File SHA-256 c94517918e63e9127222af261d82f300008356d46716ba448f531ae8b20f7aff
- Analyst observation The reviewed survey requested first name and email, but no authentication, payment, wallet, or recovery credential.
Hubeu is a hosting platform with a user-controlled wildcard subdomain namespace. Arbitrary tested subdomains resolved through hubeu-static-sites.b-cdn.net. The operator's templates page listed five community deployments at tetris.hubeu.com, maze.hubeu.com, rhythm.hubeu.com, solitaire.hubeu.com, and racer.hubeu.com; all five returned HTTP 504 during the review, so their current content and destinations could not be assessed.
- DNS fact random-review-probe-92817.hubeu.com resolved through hubeu-static-sites.b-cdn.net.
- Public artifact URL https://tetris.hubeu.com/
- Public artifact URL https://maze.hubeu.com/
- Public artifact URL https://rhythm.hubeu.com/
- Public artifact URL https://solitaire.hubeu.com/
- Public artifact URL https://racer.hubeu.com/
-
HTTP status
504 - Analyst observation The wildcard namespace cannot be exhaustively enumerated, and the five publicly listed community deployments were unavailable for content review.
The site identifies Hexer Network Oy and Finnish Business ID 3466691-9 as the Hubeu service provider. The current Finnish Patent and Registration Office open-data record matched the company name, business ID, limited-company form, Helsinki postal locality, and active register entries. This identity match supports operator continuity but does not certify all hosted user content.
- Public artifact URL https://hubeu.com/terms
- Public artifact URL https://avoindata.prh.fi/
- Page element Hexer Network Oy
- Page element 3466691-9
- Analyst observation The official record showed the company registered from 2024-08-08 with active Trade Register and VAT entries.
The apex resolved to 95.217.41.77 and presented a valid Let's Encrypt certificate covering hubeu.com and auth-api.hubeu.com from 2026-08-19 through 2026-11-17. HTTPS responses included HSTS, X-Frame-Options, and X-Content-Type-Options. Plain HTTP served the page directly with HTTP 200 instead of redirecting to HTTPS; this is a transport-hardening gap, not evidence of phishing.
- DNS fact A record observed: 95.217.41.77.
- Certificate fact Certificate subject CN=hubeu.com; issuer Let's Encrypt YR2; SAN hubeu.com and auth-api.hubeu.com.
- Certificate fact Certificate validity: 2026-08-19T18:38:50Z through 2026-11-17T18:38:49Z.
-
HTTP status
200 -
Final URL
http://hubeu.com/ - Analyst observation Plain HTTP did not upgrade to HTTPS in the reviewed request.
The current review did not identify a specific phishing page, impersonated brand, malicious file, malware payload, unrelated redirect destination, executable download, or malware hash attributable to the reviewed operator pages or the exact survey object.
- Analyst observation No reproducible phishing or malware artifact was found in the accessible reviewed scope.
Scope and limitations
- The result applies to the accessible operator pages, forms, scripts, DNS, TLS, exact survey object, and publicly listed tenant hosts reviewed at the recorded times.
- The review did not create an account, submit personal information, authenticate, deploy a project, or access post-login functionality.
- The five publicly listed community deployments returned HTTP 504, so their current content and destinations could not be reviewed.
- The wildcard tenant namespace cannot be exhaustively enumerated; exact tenant subdomains and paths require object-specific review.
- Removing an unsupported broad phishing conclusion would not certify every current or future user-hosted object as safe.
- External vendor labels were recorded separately as context and did not control the independent verdict.
Help protect others by sharing this page on social media! The more people who know about hubeu.com, the fewer chances they have to deceive someone else. Help others evaluate hubeu.com by sharing this page on social media!