What Gridinsoft observed on Mk.cvut.cz
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260822225828-758572b4
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context โ not used for this decision
The independent current review supports a Safe classification for the public mk.cvut.cz deployment. The customer claim is confirmed for the public web surface: the former WordPress and PHP endpoints are gone, and all 33 linked HTML pages now serve coherent static club content without JavaScript, forms, harmful navigation, executable or archive delivery, or the historical external indicators. Public records support that the earlier WordPress deployment had an abnormal request state, but that state is not current. The stored Gridinsoft warning had no reproducible current first-party basis and should therefore be removed; residual external domain labels remain separately controlled contradictory context.
Analyst findings
Review 5 documented observations View evidence
The current Gridinsoft report reached mk.cvut.cz over HTTPS with HTTP 200. Before correction, it retained the Suspicious Website signature dated 2026-08-15, but its current positive-signal list was empty and the report named no exact current malicious URL, redirect, file, payload, exploit, or hash.
-
HTTP status
200 -
Final URL
https://mk.cvut.cz/ - Analyst observation The retained Suspicious Website result came from a stored exact-host signature dated 2026-08-15; the fresh report exposed an empty positive-signal array.
All 33 current public HTML paths identified through the English and Czech navigation returned HTTP 200 and coherent Student Club Masarka content. Their source contained no script, iframe, form, password field, meta refresh, executable or archive link, WordPress marker, or reference to the historical external indicators reviewed below.
- Analyst observation The reviewed HTML used one same-origin stylesheet and same-origin images and documents; it contained no JavaScript resource or inline script.
- Analyst observation All 63 unique linked /static resources returned HTTP 200 with the expected CSS, image, or PDF media type; no executable or archive resource was linked.
- Page element The pages identify Student Club Masarka as part of the CTU Student Union and provide coherent membership, equipment, news, contact, institutional, and social links.
The public deployment no longer exposes the WordPress or PHP paths checked during the review. WordPress API, login, administration, content, include, XML-RPC, index.php, test.php, and a previously published upload path all returned the same static HTTP 404 page.
-
HTTP status
404 - Analyst observation The checked paths were /wp-json/, /wp-login.php, /wp-admin/, /wp-content/, /wp-includes/, /xmlrpc.php, /index.php, /test.php, and the former WordPress upload referenced by the 2026-08-14 public scan.
- Analyst observation This confirms removal from the public web surface; it does not claim access to the private server filesystem or hosting control panel.
HTTP redirects once to the same HTTPS host, which currently resolves to the CTU and CESNET address 147.32.96.4. The certificate is valid for mk.cvut.cz and www.mk.cvut.cz from 2026-07-05 through 2026-10-03. Four request profiles from each of two network locations received the same 4,946-byte root response with identical SHA-256.
-
Redirect destination
https://mk.cvut.cz/ - DNS fact mk.cvut.cz resolves to 147.32.96.4 in AS2852 CESNET.
- Certificate fact The certificate covers mk.cvut.cz and www.mk.cvut.cz and is valid from 2026-07-05 through 2026-10-03.
- File SHA-256 f0d923a48c99da143803b6cfdaaa35383a22b3e2d3418ff87f90fd734d028b5b
Public urlscan records from 2026-08-14 and 2026-08-15 preserve the former WordPress and PHP deployment. The 2026-08-14 root initiated unexpected requests to https://1rpc.io/sepolia and https://karburatorotzhigi.com/, while the 2026-08-15 scan still showed WordPress but did not list those two hosts. This supports a real historical compromise or injection state, but it is not a preserved malware file or current malicious object.
- Public artifact URL https://urlscan.io/result/01a000b0-8e6f-76df-b5b9-cfffd297f06d/
- Public artifact URL https://urlscan.io/result/01a00768-ab7b-7786-a320-9ee91bbe62ac/
- Screenshot SHA-256 b9bfcdd555c8079c74cf420209cf609cf6ea9d7be5cfa445c8ea4ec935d952bb
- Analyst observation The 2026-08-14 primary response advertised WordPress API metadata and PHP/7.4.11, and its request table attributed the two unexpected off-site requests to https://mk.cvut.cz/.
Scope and limitations
- The verdict applies to the publicly reachable mk.cvut.cz host and its linked public content at the recorded time; it does not certify other cvut.cz subdomains or future content.
- The review did not access the private server filesystem, hosting control panel, server logs, backups, or removed WordPress database, so it confirms public removal rather than private file deletion.
- Linked PDF documents were checked for availability and expected media type but were not executed; no executable or archive download was linked by the reviewed pages.
- The historical public records preserve unexpected off-site requests but not a specific malware file, payload, exact malicious path, or corresponding hash.
- Residual external domain warnings are separately controlled context and were not used to determine the Gridinsoft verdict.
Help protect others by sharing this page on social media! The more people who know about mk.cvut.cz, the fewer chances they have to deceive someone else. Help others evaluate mk.cvut.cz by sharing this page on social media!