What Gridinsoft observed on Kexart.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260811050049-64389328
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Not used for this decision
The independent first-party review confirmed that ordinary interactions activate intentionally disruptive client-side code: looping amplified audio, fullscreen requests, a pointer-blocking and rapidly flashing overlay, leave-page interference, and sustained CPU, memory, canvas, and DOM workloads. These behaviors are unrelated to the presented art portfolio and support the Suspicious Website classification. No separate malware payload or credential-theft flow was identified in the reviewed scope.
Analyst findings
Ordinary interactions activate a hostile page trap
The shipped application code deliberately turns common button and link clicks into a fullscreen, audio, flashing-overlay, pointer-blocking, and leave-confirmation sequence that impairs normal control of the page.
Deliberate client resource consumption
The activated routine performs repeated CPU, memory, canvas, animation, and DOM work unrelated to displaying an art portfolio, creating a material browser-stability and usability risk.
Visible contact and trust controls are nonfunctional
The contact button does not submit the displayed form, while the social, privacy, and terms controls use empty fragment destinations; the ordinary-looking controls instead expose users to the disruptive global click handler.
No specific malware payload identified
The reviewed behavior is a hostile client-side interaction and resource-abuse routine. The review did not identify a separate executable malware payload, credential exfiltration, or unrelated download destination, so the evidence supports Suspicious Website rather than a malware-distribution claim.
Review 7 documented observations View evidence
The public root page returned an art-portfolio interface over HTTPS, but several visible trust and contact controls were placeholders rather than working destinations.
-
HTTP status
200 -
Final URL
https://kexart.com/ - Page element The page contained eight fragment-only href=# controls: six Instagram, Twitter, and LinkedIn icons plus Privacy Policy and Terms of Service links.
- File SHA-256 38526791e58c90cf496d600cd39671698e4063d84342f72c9cbe2355948f7b77
The visible contact form had no submission destination, and its Send Message control did not implement message delivery.
- Page element The form element had no action attribute.
- Page element The Send Message control was type=button and its component-level click handler only called preventDefault().
- Analyst observation A separate document-level capture-phase click handler intercepted the button interaction before the form component could provide normal behavior.
The site's shipped client script intentionally converted ordinary button and link clicks outside the navigation area into a disruptive full-page interaction trap.
- File SHA-256 722f065406951f1d84021f125850c9e8d807953323ef6578f9193bbd8330fa8a
- Page element The capture-phase handler matched BUTTON, A, role=button, and cursor-pointer targets outside nav, header, and menu elements.
- Analyst observation The triggered routine requested fullscreen, added a full-viewport pointer-blocking overlay, applied rapidly cycling RGB and inversion animations, and displayed CHUCHE PVT LIMITED attribution text.
- Screenshot SHA-256 61ecf506ad4c98bbcf98224d60cade3df0bf330975b638584439e71fed2dce55
The client script interfered with leaving the page and repeatedly attempted to re-enter disruptive states after user interaction.
- Page element The script registered a beforeunload handler that set returnValue and caused the browser to display a leave-page confirmation.
- Page element After activation, fullscreen requests were scheduled by a one-millisecond interval and were also attached to click, keydown, touchstart, and scroll events.
- Analyst observation Visibility and focus handlers attempted to resume audio playback when the page became visible or regained focus.
The activated routine contained deliberate browser resource-consumption logic unrelated to the stated art-portfolio function.
- Page element The script started repeated busy loops, recursive Fibonacci and prime-number calculations, large array allocation and sorting, repeated string processing, canvas drawing, and short-lived DOM-node creation.
- Page element One animation loop created 50 full-page elements per frame for up to five seconds and included a 100000-iteration empty loop on each frame.
- Page element The audio routine created four looping players for /prankaudio.mp3 and applied Web Audio gain value 3 when supported.
The referenced same-site prank asset was a short MP3 audio file; no specific executable, malware payload, credential submission, unrelated redirect, or data-exfiltration endpoint was identified in the reviewed public code and HTTP scope.
-
HTTP status
200 - MIME type audio/mpeg
- File SHA-256 28f3cd298d00acbef886d0b3284285fa9b1383d74c629d782b843e8fdeb8ce12
- Analyst observation The 52695-byte audio asset was approximately 3.158 seconds long and was configured to loop.
- Analyst observation No specific malicious file, payload, URL, or hash was identified in the reviewed public scope.
The domain used Cloudflare-hosted addresses and presented a currently valid certificate for kexart.com; these infrastructure facts did not mitigate the observed client-side behavior.
- DNS fact The reviewed DNS response used Cloudflare anycast A and AAAA addresses, with authoritative nameservers under cloudflare.com.
- Certificate fact Google Trust Services WE1 certificate for kexart.com, valid from 2026-06-18 through 2026-09-16.
Scope and limitations
- The review covered the public root page, its shipped client code, the referenced same-site audio asset, DNS, TLS, and the supplied interaction screenshot; no credentials or personal data were submitted.
- The intentionally resource-intensive routine was not allowed to run for an extended period to avoid unnecessary system impact; its activation and operations were verified from the delivered client code and the recorded browser behavior.
- The result applies to the public site content and behavior reviewed at the recorded time and does not predict future changes.
Help protect others by sharing this page on social media! The more people who know about kexart.com, the fewer chances they have to deceive someone else. Help others evaluate kexart.com by sharing this page on social media!