What Gridinsoft observed on pablooo.club
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20261021151416-18c29c3d
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Screenshot Library — Current Broad Detection Unsupported; Exact-Object Review Required
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review did not reproduce phishing or malware behavior on pablooo.club. The fresh Gridinsoft result retained a broad category without a named harmful object or positive behavior observation; the current operator routes, thirty sampled screen pages and thirty image objects, targeted form and redirect checks, and reviewed client modules did not expose credential submission, an unrelated harmful redirect, an automatic executable download, or a specific malicious payload or hash. The exact phishing-themed indexed page was a static anti-scam screenshot with no form or password input. Public adverse OSINT consisted of proximity or domain-blacklist labels without a disclosed reproducible sample. This evidence contradicts the broad Phishing classification and supports removing it. A domain-wide Safe certification is nevertheless not warranted because pablooo.club is a changing user-controlled screenshot library whose complete object namespace cannot be enumerated; future allegations require exact-object review.
Analyst findings
Review 6 documented observations View evidence
A fresh supported Gridinsoft result reached the current pablooo.club service with HTTP 200. The result retained a broad Phishing category but exposed no positive behavior observation and named no exact credential receiver, unrelated redirect, malicious file, payload URL, execution trace, or payload hash supporting that category.
- Public artifact URL https://gridinsoft.com/online-virus-scanner/url/pablooo-club
-
HTTP status
200 -
Final URL
https://pablooo.club/ - Analyst observation The retained category was domain-wide; the current result did not identify a harmful exact object or reproducible phishing behavior.
The root, robots, sitemap, about, contact, legal, privacy, terms, and other sitemap-listed operator routes returned the same current screenshot-library service over HTTPS. Desktop, mobile, Googlebot, and Gridinsoft review request profiles all reached the service with HTTP 200 and no unrelated redirect. The visible site identifies its purpose as a searchable screenshot library and its operator presentation as Graines SAS; that presentation was recorded but not treated as independent identity verification.
-
HTTP status
200 -
Final URL
https://pablooo.club/ - Page element Search in Pablooo.club screenshots library
- Public artifact URL https://pablooo.club/sitemap.xml
- Public artifact URL https://pablooo.club/legal
- Public artifact URL https://pablooo.club/privacy
- Analyst observation No request profile produced cloaked service identity, an off-site final destination, an automatic download, or a credential-submission flow on the reviewed operator routes.
The public search API reported an estimated 4,293 screenshot records. Thirty current results were selected from its response; every corresponding pablooo.club screen page returned HTTP 200 without an unrelated redirect, and each associated cdn.pablooo.club object returned HTTP 200 as image/jpeg without a redirect. The reviewed client modules implemented search, screenshot detail, download, copy, save, and share functions for the library. They did not expose a credential-exfiltration receiver, automatic executable download, crypto-wallet secret collector, or unrelated redirect instruction in the reviewed paths.
-
HTTP status
200 - Page element Public search estimatedTotalHits: 4293
- Analyst observation Sample: 30 current screen pages and their 30 corresponding image objects; all 60 responses were HTTP 200 and remained within the pablooo.club service hosts.
- MIME type image/jpeg
- Analyst observation Thirty-four current client modules were reviewed for the public search and screen-detail behavior.
An exact publicly indexed page whose metadata mentions phishing returned a Pablooo library detail page for a static Vinted informational screenshot titled as a scam-prevention example. The HTML exposed one library search input, no form element, no password input, no submission receiver, and one JPEG screenshot. This is a reference image depicting a phishing warning, not a reproduced phishing workflow.
-
HTTP status
200 -
Final URL
https://pablooo.club/screen/74716bf65c96a1d9f5f2ffc5e2729a2acf7b0095a6082a345fbcd4c093527583/Vinted/informational/Scam%20prevention%20screen%20with%20example%20of%20phishing%20message. - Page element Scam prevention screen with example of phishing message.
- Page element Form elements: 0; password inputs: 0; library search inputs: 1
- MIME type image/jpeg
- Analyst observation The reviewed object displayed the screenshot as library content and did not submit credentials or redirect to a credential receiver.
Public OSINT for the exact host and registrable parent, both pablooo.club, did not disclose a preserved harmful sample. Twenty-five urlscan records covered the root and service hosts and generally showed the screenshot library; OTX reported zero pulses and no Safe Browsing match in its listed URLs. Hybrid Analysis listed August root submissions with a proximity tag and a malicious score but no public exact payload or execution trace. A public GitHub report described Avast blocking the favicon as a generic URL blacklist, explicitly without malware execution or exfiltration. Wayback preserved eight successful root snapshots from 2025-02 through 2026-01 and many library screen routes, but no incident-window snapshot.
- Public artifact URL https://urlscan.io/result/019fcf62-6e29-75ab-ab75-794b531201e3/
- Public artifact URL https://otx.alienvault.com/indicator/domain/pablooo.club
- Public artifact URL https://hybrid-analysis.com/submissions/sandbox/urls
- Public artifact URL https://github.com/anthropics/claude-code/issues/84643
- Public artifact URL https://web.archive.org/web/*/pablooo.club/*
- File SHA-256 892a8facbaf1f13c2869e40a390f756c8e834c15363b332c4db8d101e79a2b23
- Analyst observation The SHA-256 is for the currently served 892-byte SVG favicon named in the public Avast blacklist report; it is not a malware payload hash.
Pablooo describes a collaborative library whose screenshot records can be supplied by users and are public by default. The current public API exposes thousands of changing screenshot objects, including reference images of login, password, payment, one-time-code, wallet, and anti-phishing interfaces. The sampled objects and targeted searches were reviewed, but the entire current, deleted, private, unindexed, and future namespace cannot be exhaustively assessed. A clean operator surface therefore cannot certify every user-supplied image or future exact URL.
- Public artifact URL https://pablooo.club/privacy
- Public artifact URL https://pablooo.club/terms-of-service
- Page element Collaborative public screenshot library with user-supplied content
- Analyst observation Exact-object review remains necessary for any future allegation involving a specific screenshot page, image, download, or destination.
Scope and limitations
- The review covered the operator routes, four request profiles, thirty current screen pages and their thirty image objects, targeted searches for phishing and sensitive-interface terms, the public client modules used by those paths, DNS, redirects, forms, downloads, and public historical or reputation records. It did not visually review every screenshot in the changing library.
- No account was created, no credentials or personal data were submitted, and private, deleted, administrative, unpublished, or future objects were not accessed.
- Public search, sandbox, threat-intelligence and archive coverage is incomplete. Missing records do not establish the absence of historical abuse.
- The Internet Archive preserved the service before the August 2026 warning period but exposed no incident-window snapshot, so it cannot prove the state of every exact object at the time an external blacklist entry was created.
- The result distinguishes removal of an unsupported broad domain detection from certification of all current or future user-controlled content.
Help protect others by sharing this page on social media! The more people who know about pablooo.club, the fewer chances they have to deceive someone else. Help others evaluate pablooo.club by sharing this page on social media!