What Gridinsoft observed on Mexicobeach.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260901190040-b2e8ff9e
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The current public mexicobeach.com deployment is Safe in the reviewed scope. The August NoChain and ClickFix compromise is independently confirmed by archived object-level evidence, but its malicious service-worker URL and page injection are no longer present, and no current malicious object or behavior was reproduced across the representative public surface.
Analyst findings
Review 6 documented observations View evidence
The www host redirected once to the same-site apex homepage, which returned the expected Mexico Beach tourism content. Windows, macOS, crawler, and command-line request profiles received identical current page content.
-
HTTP status
200 -
Final URL
https://mexicobeach.com/ - Analyst observation Four request profiles received identical current homepage content, without an unrelated redirect, fake verification prompt, command-copy instruction, or automatic download.
Thirty representative public URLs were reviewed across the site's 266 sitemap entries, including pages, posts, events, venues, categories, contact, privacy, and uploaded HTML content. The reviewed responses did not contain the historical NoChain contract, service-worker registration, ClickFix instructions, PowerShell or mshta commands, or clipboard-execution behavior.
- Public artifact URL https://mexicobeach.com/wp-sitemap.xml
- Analyst observation The sampled current pages remained on the expected tourism site and did not reproduce the historical injection or a current malicious object.
The exact service-worker URL used during the August compromise now returns HTTP 404, and current reviewed pages do not register or reference it.
-
HTTP status
404 - Analyst observation No current reviewed page contained nochain-sw.js, the historical contract address, or a serviceWorker.register call for that worker.
A public snapshot captured on August 24, 2026 preserves a real malicious homepage injection. It registered /nochain-sw.js and loaded attacker-controlled instructions through Base smart contract 0x58460d0b3d4d6b03761c89120393c0c676676496.
- Public artifact URL https://web.archive.org/web/20260824093544id_/https://mexicobeach.com/
- Page element The archived page contains a serviceWorker.register call for https://mexicobeach.com/nochain-sw.js and the Base contract address 0x58460d0b3d4d6b03761c89120393c0c676676496.
The archived service worker intercepted HTML navigations, removed content-security-policy headers, injected a script, and retrieved mutable instructions through public Base RPC endpoints. This confirms an object-level malicious delivery mechanism rather than a blacklist-only domain label.
- Public artifact URL https://web.archive.org/web/20260824093642id_/https://mexicobeach.com/nochain-sw.js
- Page element The archived worker handled navigation requests, deleted content-security-policy response headers, and injected code obtained through the same Base contract.
A standalone ethers.js library remains publicly reachable under the former plugin path, but its current content does not contain the historical contract, loader, service-worker registration, or ClickFix instructions, and the reviewed current pages do not reference it.
-
HTTP status
200 - MIME type application/javascript
- Analyst observation The reachable file identifies itself as ethers.js 6.16.0; the malicious loader and contract address are absent, and no reviewed current page references this path.
Scope and limitations
- The review covered the current unauthenticated public root, www redirect, 30 representative URLs sampled from 266 sitemap entries, the historical malicious service-worker URL, public DNS and TLS, and archived incident evidence; it did not access server files, logs, the database, WordPress administration, email systems, or private accounts.
- Browsers that visited during the compromise may retain an installed service worker until their browser performs an update or unregistration. The current origin returns 404 at the former worker URL and does not register it for new visits, but previously affected browser storage was not available for review.
- The standalone ethers.js library under the former plugin path remains publicly reachable but is not referenced by reviewed current pages and does not contain the historical malicious loader. Server-side ownership and cleanup of the remaining plugin directory were not assessed.
- The result applies to the public content and behavior reviewed at the recorded time; future content or an exact URL that behaves differently requires separate review.
Help protect others by sharing this page on social media! The more people who know about mexicobeach.com, the fewer chances they have to deceive someone else. Help others evaluate mexicobeach.com by sharing this page on social media!