What Gridinsoft observed on sahabti.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260823205918-8ed6f15e
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review supports Safe for sahabti.com. Every concrete first-party issue retained in the previous review has been remediated, including the final unresolved dbs.sahabti.com wildcard. The refreshed Gridinsoft scan has no positive current first-party signal, and the reviewed root, sitemap, operator, authentication, administration, API, documentation, legal, status, redirect, DNS, TLS, and legacy-path surfaces do not reproduce malicious behavior or an exact malicious object. Public tenant examples now belong to the separate registrable domain sahabti.app or use address-and-port access, so they do not create a customer-controlled namespace below sahabti.com. External provider labels remain separate contradictory context and did not determine this verdict.
Analyst findings
Review 7 documented observations View evidence
A fresh supported Gridinsoft rescan reached the current HTTPS site successfully. Before correction it retained the stored Suspicious Website signature dated 2026-06-14, but the current first-party positive-signal list was empty and the report named no exact malicious URL, file, payload, redirect destination, exploit, credential recipient, or hash.
-
HTTP status
200 -
Final URL
https://sahabti.com/en - Analyst observation DomainRescanService completed successfully for sahabti.com; the retained result came from the stored signature dated 2026-06-14T13:00:08.291000.
- Analyst observation The refreshed raw report recorded positive_signals as an empty array and identified no exact current malicious object.
The previously unresolved database-routing wildcard is no longer present. Both authoritative name servers returned NXDOMAIN for dbs.sahabti.com, the earlier generated test name, a new generated name below dbs.sahabti.com, db.sahabti.com, and a new generated name below db.sahabti.com. A generated label directly below sahabti.com also returned NXDOMAIN.
- DNS fact lina.ns.cloudflare.com and evan.ns.cloudflare.com each returned NXDOMAIN for dbs.sahabti.com and random-check-20260821.dbs.sahabti.com.
- DNS fact Both authoritative servers returned NXDOMAIN for codex-check-20260823-7f4a.dbs.sahabti.com, db.sahabti.com, and codex-check-20260823-7f4a.db.sahabti.com.
- DNS fact The same retired names produced no A answer through Cloudflare, Google, and Quad9 public resolvers; a new arbitrary label directly below sahabti.com returned NXDOMAIN authoritatively.
The root, login, registration, password-reset, administrator, identity, and API HTTP endpoints now redirect to HTTPS. Reviewed HTTPS responses included a two-year HSTS policy with includeSubDomains and the stated content-type, frame, referrer, and permissions headers. The HTTPS pages presented coherent Sahabti operator, account, and administration interfaces rather than an unrelated destination.
-
Redirect destination
http://app.sahabti.com/login, /register, and /reset-password each returned HTTP 301 to the same path over HTTPS. - Page element Strict-Transport-Security: max-age=63072000; includeSubDomains
- Page element Registration collected full name, email, and password and displayed linked Terms of Service and Privacy Policy consent text before account creation.
- Analyst observation The reviewed root, app, admin, identity, and API surfaces produced only same-service redirects or their documented first-party content and status responses.
All 38 URLs in the current sitemap returned HTTP 200 HTML and coherent bilingual content for the managed-infrastructure platform. The reviewed operator, documentation, legal, status, authentication, and administration pages did not reproduce a phishing kit, malware delivery, deceptive or unrelated redirect, injected topic, executable or archive download, or off-site credential destination.
- Public artifact URL https://sahabti.com/sitemap.xml
- Analyst observation The sitemap contained 38 URLs; all 38 returned HTTP 200 with text/html content.
- Page element Managed services, isolated by design.
- Analyst observation Reviewed absolute runtime references remained within sahabti.com, app.sahabti.com, documented sahabti.app examples, or standard document namespaces; no unrelated content host or automatic download was reproduced.
The English and Arabic Terms, Privacy, DPA, and Security pages contain completed policy text without the previously recorded template placeholders. The registration page links Terms and Privacy in its consent text. The status page places a Sample data disclosure before the illustrative uptime grid and incident history in document order.
- Public artifact URL https://sahabti.com/en/legal/terms
- Public artifact URL https://sahabti.com/en/legal/privacy
- Public artifact URL https://sahabti.com/en/status
- Analyst observation The previous [date], [legal entity name], privacy-contact, security-contact, not-yet-reviewed, and replace-every-placeholder markers were absent from both language versions.
- Page element Sample data — These figures are illustrative — they show what this section will look like, not real measurements.
The current connection documentation describes public database access by a dedicated or shared address and port. Its hostname examples use db.sahabti.app, a separate registrable domain, and the text explicitly tells users not to disable certificate verification while providing certificate-pinning steps. MariaDB and Memcached are described as private-only. No customer-controlled hostname or delegated web-content namespace was reproduced below sahabti.com.
- Public artifact URL https://sahabti.com/en/docs/connecting
- Page element Public access uses a dedicated address on the engine's native port or a shared workspace address with a per-instance port.
- Page element Do not switch verification off; pin the instance certificate instead.
- DNS fact The reviewed sahabti.com DNS tests found no wildcard under the registrable domain; sahabti.app is a separate registrable domain and is outside this verdict.
Representative paths associated with the domain's pre-registration WordPress deployment now return HTTP 410 after any canonical slash redirect. The reviewed paths did not serve legacy WordPress content, scripts, feeds, or downloadable objects.
-
HTTP status
410 - Analyst observation /wp-admin, /wp-json, /feed, /wp-content/uploads/test.php, /wp-includes/test.php, /index.php, and /legacy.html all ended with HTTP 410.
Scope and limitations
- The verdict applies to the publicly reachable sahabti.com deployment and reviewed fixed first-party subdomains at the recorded time; it is not a guarantee about future content or private infrastructure.
- The separate registrable domain sahabti.app, its wildcard, future customer web applications, direct public database addresses, and private tenant instances are outside this sahabti.com verdict.
- The review did not create an account, submit credentials or personal information, complete OAuth, provision a service, or connect to a tenant database protocol.
- Private source code, orchestration systems, internal networks, server files, databases, logs, and administrative sessions were not audited.
- No exact historical malicious URL or preserved malware file, payload, or hash was available for analysis; none was inferred from the stored domain label.
- External security-provider labels are separately controlled contradictory context and were not used to determine the current Gridinsoft verdict.
