What Gridinsoft observed on rmbbhealth.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20261022175600-77e328f2
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The reviewed public site at rmbbhealth.com and its www alias is assessed Safe at the review time. The current review is consistent with the existing classification.
Analyst findings
Review 4 documented observations View evidence
The homepage returned HTTP 200; www redirected to the apex. Browser inspection of the homepage, services, about-us and contact-us pages showed healthcare billing content without a fake verification prompt, unsolicited download or unrelated automatic redirect.
-
HTTP status
200 -
Final URL
https://rmbbhealth.com/ - Public artifact URL https://www.rmbbhealth.com/
- Public artifact URL https://rmbbhealth.com/services/
- Public artifact URL https://rmbbhealth.com/about-us/
- Public artifact URL https://rmbbhealth.com/contact-us/
The four page sources, inline scripts and 24 linked JavaScript resources were examined. No active malicious loader or previously recorded EtherHiding-related host reference was identified. The contact form and its visible JavaScript used same-origin endpoints; no data was submitted. Old Bluehost navigation links remain and should be corrected by the owner.
- Analyst observation No current malicious URL, executable sample or payload hash was established within the reviewed scope.
The exact apex is also the registrable parent of www. Public-index and sandbox searches covered both. urlscan returned five apex-page records dated 2026-09-24, 2026-09-26, 2026-09-29, 2026-10-06 and 2026-10-22, plus a separate VPN-host record. OTX lists one root URL dated 2026-10-20 with HTTP 200 and no Safe Browsing matches. These metadata do not establish a malicious sample or certify safety.
- Public artifact URL https://urlscan.io/result/01a16161-1803-7516-8864-8fecfc06aead/
- Public artifact URL https://otx.alienvault.com/indicator/domain/rmbbhealth.com
A preserved ThreatFox-index reference dated 2026-09-25 and an indexed SOCRadar copy associate the domain with Unknown Loader/EtherHiding before the reported cleanup. They do not demonstrate current delivery. The reviewed Wayback snapshot from 2024-09-12 shows healthcare billing content on www2.rmbbhealth.com, a separate host; it cannot verify remediation of the apex.
- Public artifact URL https://threatfox.abuse.ch/browse/
- Public artifact URL https://socradar.io/free-tools/ioc-radar/reports/abuse-ch-threatfox-8234-indicators-631a0308b684
- Public artifact URL https://web.archive.org/web/20240912094432/https://www2.rmbbhealth.com/
Scope and limitations
- This review does not certify private portals, other subdomains, server-side integrity or every conditional response. Same-origin form endpoints alone cannot prove how a server handles submitted data.
- No original compromised file or dated cleanup log was available. The reported private remediation and the original payload could not be independently verified.
- Search and archive coverage is incomplete. Detailed historical scanner behavior was not established, and no original malware sample was independently examined. A missing search result is not proof of absence; available vendor results are not a fresh vendor rescan.
Help protect others by sharing this page on social media! The more people who know about rmbbhealth.com, the fewer chances they have to deceive someone else. Help others evaluate rmbbhealth.com by sharing this page on social media!