Obloga.hr Reputation Check

A supported fresh Gridinsoft rescan retained Phishing from an active domain signature dated 2026-04-05. The current raw report contained an empty positive-signals array and identified no exact phishing page, credential receiver, malicious redirect, file, hash, exploit, or injected payload attributable to the current deployment.

• Page element checker.category: Phishing; signature: obloga.hr; signature datetime: 2026-04-05T06:00:10.068000
• Analyst observation The supported fresh report was written at 2026-08-21T22:23:35Z with SHA-256 8ecc2fe9d22f4bdc35b997a8229e9ff8d6b6837eaa602aab82bb886e1c25fc0e.
• Analyst observation The fresh raw report recorded positive_signals as an empty array.

The current sitemap enumerated 146 public HTML URLs: nine general pages, 116 product pages, and 21 product-category pages. All 146 returned HTTP 200 at same-site HTTPS destinations with zero fetch errors and consistently presented the same Croatian wall-panel and interior-covering store, product catalogue, contact information, and consumer documents. No unrelated destination, injected topic, brand impersonation, meta refresh, automatic executable or archive download, or hidden credential form was reproduced.

• HTTP status 200
• Final URL https://obloga.hr/
• Page element 146 reviewed sitemap HTML URLs; 146 HTTP 200 responses; 0 fetch errors; 0 external final hosts
• Page element Početna | obloga.hr

The reviewed forms were ordinary same-site catalogue search, product sorting, add-to-cart, cart, and checkout functions. A product was placed in an isolated review session so the checkout could be inspected without submitting an order. The checkout stayed on obloga.hr, exposed standard billing and delivery fields, and listed cash on delivery as the available payment method; it did not request a password, payment-card number, authentication code, recovery phrase, or unrelated service credential. No order, payment, personal data, or account credential was submitted.

• HTTP status 200
• Final URL https://obloga.hr/checkout/
• Page element The current checkout data declared payment_method=cod and payment_methods=[cod].
• Analyst observation The checkout was inspected without entering data, placing an order, or making a payment.

Repeated root requests using desktop, mobile, Googlebot, GridinsoftBot, and curl user agents all returned the same 165,328-byte HTTPS homepage with the same SHA-256 digest. Across the 146 sitemap pages, the declared external hosts were limited to the store's social profiles, a map link, cookie documentation, and a public JavaScript package CDN. The reviewed HTML contained no meta refresh, external iframe, eval call, atob call, document.write call, or long embedded Base64 block.

• File SHA-256 cec37d9951748a87fdaabc8a5aebb3fd2f82da60c4f50cb851fdcaffdad66a14
• Page element Five reviewed user-agent variants returned HTTP 200, https://obloga.hr/, 165328 bytes, and the same SHA-256 digest.
• Analyst observation The reviewed sitemap HTML contained 0 meta refreshes, 0 external iframes, 0 eval calls, 0 atob calls, 0 document.write calls, and 0 Base64 strings longer than 500 characters.

The exact legacy process.php path identified in public historical context now returned HTTP 404 with the current branded not-found page for desktop, Googlebot, GridinsoftBot, and curl user agents. Its trailing-slash variant also returned HTTP 404. No live receiver, form, redirect, or payload was reproduced at either current path.

• HTTP status 404
• Final URL https://obloga.hr/process.php
• Analyst observation Four user-agent variants returned HTTP 404 for the path /process.php; four also returned HTTP 404 for the trailing-slash path /process.php/ in each case.

The only downloadable document linked from the 146 reviewed pages was the store's one-page cancellation form. It was a 1,483-byte unencrypted PDF 1.3 document with no interactive form, JavaScript, or embedded file. No executable, archive, script, installer, or automatic download was linked from the reviewed public pages.

• MIME type application/pdf
• File SHA-256 f56770f803239a18f1f7a700b33a15d1e84b5829551fe1b5f7a91fcfc5bd382e
• Analyst observation PDF inspection reported one page, no encryption, no form, no JavaScript, and zero embedded files.

The public contact, about, privacy, terms, cookie, and withdrawal pages consistently described the same Croatian merchant and store. The terms disclosed pricing, delivery, cancellation, returns, refunds, and complaints, while the privacy page described order and customer-contact data. These public disclosures were consistent with the product catalogue and checkout flow and did not impersonate another brand.

• Public artifact URL https://obloga.hr/kontakt/
• Public artifact URL https://obloga.hr/politika-privatnosti/
• Public artifact URL https://obloga.hr/jednostrani-raskid-ugovora/
• Analyst observation The pages were inspected without contacting the merchant or submitting personal data.

Plain HTTP and www redirected to the same HTTPS root. The apex resolved to 178.218.165.133, used the declared Plus Hosting nameservers, and served a valid Let's Encrypt certificate for the root and known mail and hosting-service names. HTTPS exposed HSTS, content-type, framing, referrer, and permissions controls. The known autoconfiguration, autodiscovery, cPanel, calendar, contacts, mail, webdisk, and webmail hosts returned same-domain store content or expected hosting-service responses without an unrelated destination. No credentials were entered.

• Redirect destination https://obloga.hr/
• DNS fact A: 178.218.165.133; MX: mail.obloga.hr; nameservers: ns1.mojsite.com and ns2.mojsite.com.
• Certificate fact Certificate subject CN=obloga.hr; issuer Let's Encrypt YR2; validity 2026-07-10T07:44:52Z through 2026-10-08T07:44:51Z.
• Analyst observation No authentication was attempted on the reviewed cPanel, calendar, contacts, webdisk, or webmail endpoints.

The current review did not reproduce phishing, brand impersonation, a hidden credential receiver, an unrelated or changing redirect, automatic executable delivery, an exploit, an injected topic, a concealed loader, or a specific malicious file, payload, URL, or hash in the accessible reviewed scope. The review did not access the private server filesystem, database, scheduled tasks, hosting security console, or Google Search Console, so the requester's private-scan statements were not independently verified and were not used for the verdict.

• Analyst observation No reproducible current Gridinsoft-owned phishing or malware artifact was found in the accessible reviewed scope.
• Analyst observation The verdict follows from the current public deployment and exact reviewed flows, not from the requester's private-scan claims or external vendor intelligence.