What Gridinsoft observed on marccloud.live
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260809231307-636c3323
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Not used for this decision
The independent first-party review found a coherent EnergySolution Labs industrial monitoring platform and did not identify malicious behavior in the reviewed public pages, navigation, login presentation, application resources, or same-origin API behavior. The prior Suspicious Website classification is not supported by the current first-party evidence.
Analyst findings
Review 6 documented observations View evidence
Repeated public requests and browser navigation consistently served the MARC application and resolved the root route to the same-site login page without an unrelated redirect.
-
HTTP status
200 -
Final URL
https://marccloud.live/login - Analyst observation The root, login, and sampled public routes returned the same application shell across normal, command-line, Googlebot, and Bingbot user agents; no conditional external destination was observed.
The reviewed public pages consistently identified MARC as an industrial monitoring and analytics platform operated by EnergySolution Labs Pvt. Ltd and provided coherent contact, privacy, and terms information.
- Public artifact URL https://marccloud.live/about
- Public artifact URL https://marccloud.live/contact
- Public artifact URL https://marccloud.live/privacy-policy
- Public artifact URL https://marccloud.live/terms
- Page element The About, Contact, Privacy Policy, and Terms pages used the same MARC and EnergySolution Labs identity, support contacts, and industrial monitoring purpose.
The public login form requested an email address and password for the MARC platform, and the reviewed application code routed authentication to the same-origin MARC API.
- Page element The rendered form contained one email field, one password field, a sign-in button, and MARC support and policy links.
- Public artifact URL https://marccloud.live/apifromweb/authenticated
- Analyst observation The production JavaScript configured apiBase as https://marccloud.live/apifromweb and used the same-origin /authenticateUser endpoint; an unauthenticated status request returned authenticated=false.
The operator website and the public App Store listing independently matched the EnergySolution Labs identity and the stated industrial energy-monitoring purpose of MARC.
- Public artifact URL https://www.goesl.co/
- Public artifact URL https://apps.apple.com/us/app/marc-energy/id1360661298
- Analyst observation The operator site described IIoT and energy-management software, while the App Store identified marc.energy as an EnergySolution Labs Private Limited application.
The reviewed public application resources supported the displayed monitoring platform and did not expose an automatic executable download, credential forwarding to an unrelated host, wallet workflow, or cryptocurrency-mining behavior in the unauthenticated flow.
- Public artifact URL https://marccloud.live/main.5d0704e420f1aee3be3e.js
- Analyst observation The rendered login page loaded the MARC application bundles, localization data, images, fonts, and analytics resources; no iframe, meta refresh, popup, or automatic download was observed.
- Analyst observation No specific malicious file, payload, URL, or hash was identified in the reviewed public pages, navigation, application resources, or same-origin API behavior.
The domain resolved consistently and presented a currently valid certificate covering marccloud.live and its subdomains.
- DNS fact marccloud.live resolved to 34.236.93.219 and used the ns-188.awsdns-23.com, ns-629.awsdns-14.net, ns-1593.awsdns-07.co.uk, and ns-1331.awsdns-38.org name servers.
- Certificate fact A GlobalSign certificate covered marccloud.live and *.marccloud.live from 2026-06-16 through 2027-01-01.
Scope and limitations
- The review covered public unauthenticated pages and resources; it did not submit credentials or inspect private tenant data and authenticated customer workflows.
- The result applies to the public content and behavior reviewed at the recorded time and does not predict future changes.
- The sampled root response did not advertise HSTS or a page-level Content Security Policy; this is a security-hardening opportunity, not evidence of malicious behavior.
