What Gridinsoft observed on Scuolatao.ch
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260905191527-8840745f
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The cleanup is confirmed for the reviewed scope. The previously observed obfuscated loader is no longer served by the affected public pages, and no current first-party basis remains for the Suspicious Website warning.
Analyst findings
Review 3 documented observations View evidence
The apex redirected to the HTTPS www school website. The homepage, contact page and privacy page returned the expected school content from two networks. The previously observed encoded loader, its blockchain request identifiers and xaz2.com reference were absent from all three current HTML responses.
-
HTTP status
200 -
Redirect destination
https://www.scuolatao.ch/ - Public artifact URL https://www.scuolatao.ch/
- Public artifact URL https://www.scuolatao.ch/contatti/
- Public artifact URL https://www.scuolatao.ch/privacy/
Thirty same-origin script resources referenced by the current homepage were retrieved and reviewed for the distinctive former loader chain. The constructor-based loader, blockchain contract and selector, and xaz2.com destination were not found. One standard Elementor bundle used a generic atob call, without the former loader identifiers or behavior.
- Analyst observation The distinctive previously recorded loader chain was not reproduced in the current page or its 30 same-origin script resources.
The separate learning host served its public Moodle homepage, course index, login page and password-recovery page over HTTPS. The reviewed forms targeted the learning host, and the previously observed loader indicators were absent from these current responses.
-
HTTP status
200 - Public artifact URL https://elearning.scuolatao.ch/
- Public artifact URL https://elearning.scuolatao.ch/course/index.php
- Public artifact URL https://elearning.scuolatao.ch/login/index.php
- Public artifact URL https://elearning.scuolatao.ch/login/forgot_password.php
Scope and limitations
- The review covered the named public pages and current same-origin homepage scripts; it was not an audit of every server file or historical URL.
- No account login, form submission or private course access was performed. Authenticated Moodle functions and private course materials were not assessed.
- External domain-level warning labels may remain after the underlying behavior changes; they do not identify a current malicious object by themselves.
Help protect others by sharing this page on social media! The more people who know about scuolatao.ch, the fewer chances they have to deceive someone else. Help others evaluate scuolatao.ch by sharing this page on social media!