What Gridinsoft observed on saferlinks.org
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260831000804-5bd05691
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent current review supports Safe for the public saferlinks.org application and its current admin-published directory. The site consistently served anti-scam educational content, organization buttons opened explicit HTTPS destinations directly, the fully enumerated directory contained no malformed or concealed primary destination, and a 51-record destination sample did not produce an unrelated final host. No credential-theft flow, phishing receiver, malicious URL, file, payload, automatic download, or harmful redirect was reproduced. The previous broad Phishing label was not supported by a current malicious object.
Analyst findings
Review 8 documented observations View evidence
The root domain served the SaferLinks anti-scam resource over HTTPS. The homepage, all 13 additional public routes listed in the sitemap, the manifest, robots file, and sitemap returned successfully on the expected host; the HTTP entry point redirected only to the HTTPS version of the same domain.
-
HTTP status
200 -
Final URL
https://saferlinks.org/ - Page element SaferLinks
- Analyst observation The reviewed public routes presented anti-scam education, security guidance, contact, privacy, terms, and support content.
Desktop, mobile, search-crawler, and command-line request variants all returned HTTP 200 at the same HTTPS destination and presented the SaferLinks site. No client-dependent unrelated redirect or different site purpose was reproduced.
-
HTTP status
200 - Analyst observation All four reviewed client variants ended at https://saferlinks.org/ and presented SaferLinks content.
The public directory returned 355 published organization records across 17 categories. Every primary destination was an explicit HTTPS URL; none used embedded credentials, a script or data scheme, an IP-literal host, an internationalized lookalike hostname, or a custom port. The reviewed client code opens the stored destination directly in a new tab instead of routing visitors through a SaferLinks short code or hidden redirect.
- Analyst observation 355 published organization records were enumerated; all 355 primary destinations used explicit HTTPS URLs.
- Analyst observation The reviewed destination set contained no URL credentials, script or data scheme, IP-literal host, internationalized lookalike hostname, or custom port.
- Analyst observation The website action opens each record's stored URL directly with a new-tab navigation.
A deterministic 51-record sample spanning the alphabetically ordered directory was requested independently. Thirty-three destinations returned HTTP 200; the rest returned access-control, rate-limit, legal-restriction, method, gateway, or connection responses. Every observed final URL remained HTTPS and on the expected organization or service host; no sampled destination changed to an unrelated or deceptive host.
- Analyst observation 51 directory destinations were sampled; 33 returned HTTP 200 and 18 returned non-success or connection responses.
- Analyst observation No sampled destination produced an unrelated final host or non-HTTPS destination.
- Analyst observation The sample included financial, government, health, technology, retail, media, travel, utility, and social services.
The reviewed public application did not contain a password input or request account passwords, one-time codes, or banking credentials. Contact, missing-organization, and scam-question forms use ordinary contact and incident fields with an anti-bot check. Financial-support pages delegate payment entry to established third-party payment interfaces rather than collecting card data in the SaferLinks application.
- Analyst observation No password input was present in the reviewed public application bundle.
- Page element Contact
- Page element Missing Button?
- Page element Scam or Not?
The public site consistently identifies its operator as SaferLinks LLC and its creator as Noam, describes an anti-scam directory for older adults, and links to an established fraud-prevention professional profile and consulting site. The supplied Colorado entity identifier matches an active SaferLinks LLC in good standing in the Colorado Department of State open business dataset.
- Page element SaferLinks LLC
- Page element I've built a 20-year career in Fraud Prevention
- Analyst observation Colorado entity 20261723718 is SaferLinks LLC, a Colorado limited liability company in Good Standing formed on 2026-06-15.
The parent domain resolved to the current hosted application, while www resolved through the documented hosting alias. The HTTPS endpoint presented a currently valid certificate for saferlinks.org, and the public site enforced HTTPS and same-origin navigation for its own pages.
- DNS fact saferlinks.org resolved to 216.24.57.1; www.saferlinks.org resolved through base44.onrender.com.
- Certificate fact The reviewed saferlinks.org endpoint presented a valid certificate for saferlinks.org from 2026-07-13 through 2026-10-11.
The current review did not identify a phishing receiver, deceptive sign-in page, specific malicious URL, file, payload, hash, automatic download, harmful redirect, or hidden destination under saferlinks.org. The prior Phishing result was a broad domain classification and was not tied to a reproducible malicious sample or URL.
- Analyst observation No current malicious object or phishing behavior was reproduced in the reviewed public site, directory data, client navigation, forms, or destination sample.
Scope and limitations
- The result applies to the public saferlinks.org application, the 355 organization records published at the recorded time, and the routes, forms, scripts, and destination sample reviewed.
- The review did not sign in to external organizations, place calls, submit contact or scam reports, or complete a donation or payment transaction.
- All primary directory URLs were enumerated, but the accuracy of every published phone number and every external organization's future content was not independently certified.
- Public search, sandbox, threat-intelligence, URL-scanner, and archive coverage is incomplete and may not expose private or unindexed records.
- A future change to the site or its published directory could require a new object-specific review.
Help protect others by sharing this page on social media! The more people who know about saferlinks.org, the fewer chances they have to deceive someone else. Help others evaluate saferlinks.org by sharing this page on social media!