What Gridinsoft observed on mbsretreats.net
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260828231155-8e4d7505
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The current mbsretreats.net apex and www host did not reproduce phishing, malware delivery, credential theft, request-profile cloaking, an unrelated redirect, or a harmful download across the 107-object sitemap surface, public forms, current client code, and representative request profiles. Public archives confirm older and now-removed content, including one unusual path whose archived response stored zero bytes, but they do not preserve a malicious page, payload, or behavior trace. That historical domain context differs materially from an exact current URL or file with observed harmful behavior. The prior broad Phishing classification is not supported by current reproducible first-party evidence. Remaining external blacklist labels are separately controlled contradictory reputation context, not a current preserved harmful object.
Analyst findings
Review 6 documented observations View evidence
The HTTPS apex returned HTTP 200 with the Mind Body Spirit Retreats site. HTTP upgraded to same-site HTTPS, and the www host redirected to the HTTPS apex. Desktop, crawler, and command-line profiles received byte-identical homepage content. The mobile response differed only by the expected responsive-layout body class; the content and destination were unchanged. No request-profile cloaking or unrelated redirect was reproduced.
-
HTTP status
200 -
Final URL
https://mbsretreats.net/ -
Redirect destination
https://mbsretreats.net/ - MIME type text/html
- File SHA-256 47cbda9844d80f8db826a42180b6645a487b8c483fd9432f448121fb47f07b81
- Page element Title: Mind Body Spirit Retreats
The current sitemap exposed 107 same-site pages or media objects. Ninety-seven returned HTTP 200 and ten stale image URLs returned HTTP 404. The reviewed pages consistently described the retreat and professional-training business. The public forms were an ordinary same-site contact form and standard cart or checkout controls. No password, one-time-code, recovery-secret, private-key, or unrelated credential field was present on the sitemap surface. No meta refresh, executable or archive link, automatic download, or unrelated embedded page was identified.
-
HTTP status
200 - Analyst observation All 107 same-site sitemap objects were requested: 97 returned HTTP 200 and 10 stale image objects returned HTTP 404.
- Page element The contact form requested first name, last name, email address, subject, and message and posted on the same site.
- Analyst observation No password, payment-card, one-time-code, recovery-phrase, private-key, unrelated credential field, executable or archive link, meta refresh, or automatic download was identified on the reviewed sitemap surface.
The current linked JavaScript and embedded-resource destinations matched WordPress, the Astra and Elementor presentation stack, SureCart commerce controls, the same-site contact form, Google Maps, reCAPTCHA, and accessibility components. The current public WordPress API listed the expected retreat pages and posts and returned no result for the unusual historical fashion or wire terms. No hidden payload source, credential receiver, executable delivery, or automatic external navigation was identified in the reviewed client-side surface.
- Analyst observation Linked client code served expected WordPress, Astra, Elementor, SureCart, contact-form, mapping, reCAPTCHA, and accessibility functionality.
- Analyst observation The current public page and post API exposed retreat and training content and returned no search result for the historical fashion or wire terms.
- Analyst observation No specific current malicious URL, credential receiver, delivered malware file, payload, or hash was identified in the reviewed public client-side surface.
The apex resolved to the current Hostinger deployment, www was a CNAME to the apex, and the authoritative nameservers and public RDAP record agreed. The active TLS certificate covered both mbsretreats.net and www.mbsretreats.net. A fresh supported Gridinsoft report reached the expected HTTPS deployment and contained no current positive behavior signal or exact harmful object.
- DNS fact mbsretreats.net resolved to 72.60.128.149 and 2a02:4780:3e:3:ac9e:59fb:d616:6126; www.mbsretreats.net was a CNAME to mbsretreats.net.
- DNS fact Authoritative nameservers were cosmos.dns-parking.com and nova.dns-parking.com, matching the current public RDAP record.
- Certificate fact The active Let's Encrypt certificate covered mbsretreats.net and www.mbsretreats.net and was valid from 2026-06-30 through 2026-09-28.
- Public artifact URL https://gridinsoft.com/online-virus-scanner/url/mbsretreats-net
Wayback indexed 155 deduplicated successful HTML records across the apex and www history. Representative root captures from January and May 2026 showed the same retreat-business identity. The archive index also contained one unusual fashion-shaped URL from February 2026, but the preserved HTTP 200 response had a zero-byte body and supplied no script, redirect, credential form, download, payload, or hash. That exact path and the older author and free-offer paths now return HTTP 404. This is consistent with removed historical content but is not a preserved malicious sample and does not reproduce harmful behavior on the current deployment.
- Public artifact URL https://web.archive.org/web/20260116094925id_/https://mbsretreats.net/
- Public artifact URL https://web.archive.org/web/20260512064639id_/https://mbsretreats.net/
- Public artifact URL https://web.archive.org/web/20260219085413id_/https://mbsretreats.net/fashion/0-6mm-Wire-Dia-X-6mm-OD-X-50mm-701294
-
HTTP status
404 - Analyst observation The unusual historical path is no longer live. Its archived response stored zero content bytes and did not preserve an exact malicious object, payload, redirect, credential receiver, or behavior trace.
The public urlscan search returned no indexed scan for either the apex or exact www host. OTX showed no pulse for either host; its one apex URL observation recorded HTTP 200 and no Safe Browsing match. The current Common Crawl index contained twelve successful August 2026 HTML records for ordinary retreat, cart, checkout, shop, and information pages. Public web search returned the expected business pages and domain-level reputation reports but no exact current harmful URL or delivered sample. URLhaus and ThreatFox required authorization, and an OTX request initially timed out; unavailable sources were treated as unverified, not clean.
- Public artifact URL https://urlscan.io/domain/mbsretreats.net
- Public artifact URL https://otx.alienvault.com/indicator/domain/mbsretreats.net
- Analyst observation Public indexes supplied ordinary site records and separately controlled domain-reputation labels but no exact current URL with observed phishing, malware delivery, credential theft, harmful redirect, payload, or hash.
- Analyst observation Authentication-only, rate-limited, timed-out, and unavailable sources were recorded as unverified rather than counted as clean.
Scope and limitations
- The verdict applies to the current publicly accessible apex and www deployment and the sitemap objects reviewed at the recorded time; it does not guarantee future content.
- The review covered public pages, forms, linked client code, redirects, DNS, TLS, and available public history but did not inspect hosting files, private source code, databases, server logs, administrator accounts, backups, or the complete prior incident record.
- No purchase was completed, no private account was created, and no payment-card, password, or other sensitive data was submitted during the review.
- The unusual February 2026 archive entry stored a zero-byte response. Its path shape may reflect removed unwanted content or a crawler artifact, but the preserved record cannot establish which and does not contain a malicious payload.
- Public search, URL-scan, sandbox, threat-intelligence, and archive indexes are incomplete. Missing, authentication-only, rate-limited, timed-out, or unavailable records were treated as unverified, not clean.
- Representative historical captures and the indexed unusual paths were reviewed, not every archived asset, query string, transient response, or unrecorded past server-side behavior.
Help protect others by sharing this page on social media! The more people who know about mbsretreats.net, the fewer chances they have to deceive someone else. Help others evaluate mbsretreats.net by sharing this page on social media!