What Gridinsoft observed on pimzi.app
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260903174422-45a3ab99
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent first-party review did not reproduce phishing, retailer impersonation, unrelated credential collection, malware delivery, or another harmful behavior on the current public pimzi.app service. The login and subscription flows matched the disclosed Pimzi, Supabase, and Whop service model, and the former creator route now redirected to the same-brand pimzi.fr site. Current external warnings were broad domain-reputation categories without an exact harmful object and were retained only as contradictory context. The active broad Phishing classification was not supported by reproducible current Gridinsoft-owned evidence.
Analyst findings
Review 9 documented observations View evidence
HTTP redirected to HTTPS and the HTTPS apex returned the current Pimzi meal-planning service with status 200. Desktop, crawler, and GridinsoftBot request profiles from two networks received the same 116,365-byte French root response and the same 114,862-byte English response. No request profile received a different brand, unrelated redirect, or automatic download.
-
HTTP status
200 -
Final URL
https://pimzi.app/ - MIME type text/html; charset=utf-8
- File SHA-256 749cef128e40e83b9146f715d98ea0a2f92412120f5bf42b87b46780e6dd187e
- Page element Pimzi : des dîners de la semaine, pile dans ton budget
- Public artifact URL https://pimzi.app/en
- File SHA-256 980d564b6c6e923efc6afb3d6802e7533c8890b6c1b231a9d769fe685e11fbbd
- Analyst observation The English page described a meal-planning and grocery-budget service and displayed supermarket names and logos as selectable price-reference context, not as a retailer login or account-warning interface.
The homepage and current legal pages consistently identified Pimzi as a meal-planning subscription service operated by Neobay LLC. The legal notice named Vercel for hosting, Supabase for database and authentication, and Whop for payment processing. Terms of sale described monthly and lifetime access, cancellation, withdrawal, refund, and support terms; the privacy policy described account, quiz, analytics, and advertising data processing.
- Public artifact URL https://pimzi.app/en/legal/mentions
- Public artifact URL https://pimzi.app/en/legal/cgv
- Public artifact URL https://pimzi.app/en/legal/terms
- Public artifact URL https://pimzi.app/en/legal/privacy
- Page element Pimzi is operated by Neobay LLC.
- Analyst observation The public identity and processor disclosures were consistent across the reviewed English and French pages. Subscriber count, ownership of the stated postal address, and individual customer outcomes were not independently verified.
Rendered login and signup pages were consistently branded as Pimzi account flows. The login page requested an email address and password for the user's Pimzi menus and offered Google sign-in. Current client code used a Supabase Auth project for email/password authentication and the site's same-origin callback for OAuth, matching the processor disclosed in the legal notice and privacy policy. No retailer-branded login, third-party account alert, one-time-code prompt, or unrelated credential receiver was identified.
-
HTTP status
200 - Public artifact URL https://pimzi.app/en/login
- Public artifact URL https://pimzi.app/en/signup
- Page element Welcome back — Log in to find your menus.
- Page element Your email; Your password; Forgot password?; Continue with Google
- Analyst observation The reviewed client code called the disclosed Supabase Auth service for Pimzi email/password authentication and used a pimzi.app callback for Google OAuth.
- Analyst observation No form was submitted and no test credentials were entered during the review.
The rendered quiz opened a 15-step meal-planning flow beginning with grocery-budget, time, health, and family preferences. Direct visits to the reveal and checkout routes without completed quiz state returned the user to that product flow. Current client code requested a checkout session from the same-origin Whop integration and loaded Whop's checkout script, consistent with the published payment disclosure. No card field, retailer credential field, unrelated redirect, or download was exposed in the reviewed pre-payment flow.
- Public artifact URL https://pimzi.app/en/quiz
- Public artifact URL https://pimzi.app/en/reveal
- Public artifact URL https://pimzi.app/en/checkout
- Page element A week of great dinners, just for you.
- Page element Step 1 of 15 — What brings you here?
- Analyst observation The reviewed client code created a checkout session through /api/whop/checkout-session and loaded the Whop checkout library from t.whop.tw.
- Analyst observation No payment, signup, login, or quiz submission was performed; authenticated and post-payment behavior remains outside the observed scope.
The current sitemap listed the apex and four legal pages; all five returned successful same-site HTML. Additional decision-relevant login, signup, quiz, reveal, generation, menu, and checkout paths also returned Pimzi pages. The reviewed responses contained no meta refresh, iframe, executable or archive link, file-upload control, or automatic download. The former creator page now redirected to the same-brand pimzi.fr site, while the old recruitment path returned 404.
-
HTTP status
200 - Public artifact URL https://pimzi.app/sitemap.xml
- File SHA-256 e4fb7a8b03e79dd447d63b38819a4014fd7ed4bba9910fdf6b6fd5d3e1e73318
-
Redirect destination
https://pimzi.fr/creators - Analyst observation Five sitemap pages and the additional product/account routes reviewed returned no meta refresh, iframe, executable or archive link, file upload, or automatic download.
- Analyst observation The former /creators route used a direct HTTP redirect to the same-brand pimzi.fr creator site; /recrutement returned 404.
The apex resolved to the current Vercel-served application and presented a valid certificate for pimzi.app. Certificate transparency named the apex, app, www, and a mail-link host. app.pimzi.app redirected to the apex; the mail-link root returned no content. The exact ownership-verification file supplied in the ticket returned status 200 as plain text with the expected token to both desktop and GridinsoftBot requests.
- DNS fact pimzi.app resolved to 216.150.1.1 and app.pimzi.app used a current Vercel CNAME before redirecting to the apex.
- Certificate fact The current apex certificate covered pimzi.app and was valid through 2026-11-13.
- Public artifact URL https://crt.sh/
- Public artifact URL https://rdap.org/domain/pimzi.app
-
HTTP status
200 - MIME type text/plain; charset=utf-8
- File SHA-256 389ff411773c25ead62c26eff661644ff83a9c71c86369ad082d9d20850fd13c
- Analyst observation The file proves current control of the exact web path. This investigation did not change the Portal ownership state because ticket authorization was limited to investigation, publication, and an evidence-based classification correction.
The Internet Archive index returned 117 distinct successful records from an August 30, 2026 crawl. Exact archived HTML paths included the English homepage, legal pages, login, signup, quiz, generation, reveal, reveal settings, and associated same-site application resources. Retrieved homepage, login, quiz, and reveal snapshots presented Pimzi meal-planning content; no archived exact malicious redirect or malware object was identified in the available record set.
- Public artifact URL https://web.archive.org/web/*/pimzi.app/*
- Analyst observation The bounded archive index contained 117 distinct status-200 records dated 2026-08-30, including exact HTML records for /en, /en/login, /en/signup, /en/quiz, /en/generation, /en/reveal, and /en/reveal/settings.
- Analyst observation Available replayed homepage, login, quiz, and reveal snapshots were consistent with the Pimzi meal-planning service and did not preserve an unrelated final destination.
- Analyst observation Archive availability establishes only the content that was preserved; it does not prove every historical response was safe.
Public OSINT was reviewed as non-determinative context. urlscan returned no indexed result for the exact domain. OTX reported zero threat pulses and two URL observations; both had successful HTTP responses and no Google Safe Browsing match in the OTX record. Current OpenPhish, URLhaus online/full, and ThreatFox recent/full public feeds contained no pimzi.app match. Search and reputation indexes preserved broad phishing or suspicious-domain labels, and public customer reviews included billing, access, cancellation, and antivirus-block complaints, but none of the reviewed records supplied a current exact phishing URL, verified credential submission, malware file, payload, hash, exploit, or harmful execution trace.
- Public artifact URL https://urlscan.io/
- Public artifact URL https://otx.alienvault.com/indicator/domain/pimzi.app
- Public artifact URL https://www.scamadviser.com/check-website/pimzi.app
- Public artifact URL https://fr.trustpilot.com/review/pimzi.app
- Analyst observation urlscan returned zero results; OTX reported zero threat pulses and two observed URLs, / and /en/reveal, with no Safe Browsing match recorded.
- Analyst observation OpenPhish, URLhaus online/full, and ThreatFox recent/full downloadable public feeds had no exact pimzi.app match at review time.
- Analyst observation The fresh aggregate vendor snapshot retained broad domain labels from Chong Lua Dao, CRDF, CyRadar, Emsisoft, Forcepoint ThreatSeeker, and Netcraft. Those categories did not name a current exact harmful object.
- Analyst observation A domain blacklist category or consumer complaint is materially different from an exact URL or sample with observed phishing submission or malware behavior; no such exact harmful object was present in the reviewed public records.
The current first-party review did not reproduce retailer impersonation, a third-party account-warning flow, collection of credentials for another service, an unrelated redirect, an automatic download, an executable or archive delivery path, a malware file, payload, hash, exploit, or harmful execution trace. The reviewed login was a disclosed Pimzi account flow using Supabase Auth, and the reviewed payment integration created a Whop checkout session. The active broad Phishing classification therefore lacked a reproducible current Gridinsoft-owned basis.
- Analyst observation No current exact phishing URL, third-party credential target, malware file, payload, hash, exploit, or harmful execution trace was reproduced.
- Analyst observation The fresh Gridinsoft report snapshot contained no positive first-party behavior signal supporting the active Phishing classification.
- Analyst observation Current broad domain reputation labels were kept as contradictory context and were not used to determine the first-party verdict.
Scope and limitations
- The result applies to the public apex, account entry pages, product flow, redirects, scripts, legal pages, DNS, TLS, and archived material reviewed at the recorded time. Authenticated content, completed signup, completed payment, post-payment access, server-side files, databases, logs, mailboxes, and future changes were not assessed.
- No payment, account creation, login, or subscription cancellation was performed. Public billing, access, refund, and cancellation complaints were recorded as consumer context and were not independently adjudicated by this security review.
- The exact root of www.pimzi.app currently has a certificate-name mismatch, while the appealed HTTPS apex and app alias had valid certificates. This configuration issue did not produce impersonation, credential theft, malware delivery, or an unrelated destination in the reviewed scope.
- The mail-link hostname returned no content at its root, and no exact user-specific mail-tracking URL was supplied or identified for review.
- Public search, scanner, sandbox, threat-intelligence, feed, and archive indexes are incomplete. Missing results were treated as absence of a public record, not proof that all historical behavior was safe.
- A current Safe verdict does not erase external blacklist records, consumer complaints, or the domain's short history and does not certify future content; it states that the active broad Phishing classification was unsupported by reproducible current first-party evidence in the reviewed scope.
Help protect others by sharing this page on social media! The more people who know about pimzi.app, the fewer chances they have to deceive someone else. Help others evaluate pimzi.app by sharing this page on social media!