What Gridinsoft observed on Sswamn.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260901195215-78b4b73e
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The current review supports Safe for the observed sswamn.com public deployment. The exact host is also the registrable parent domain; www redirects to it, and the retired pay hostname is NXDOMAIN. A fresh Gridinsoft rescan and four request profiles reached the expected medical-spa site with HTTP 200. Ninety public URLs were discovered and 24 representative sitemap pages plus core routes were reviewed without reproducing an unrelated redirect, command-execution prompt, external credential receiver, automatic download, executable or archive link, harmful iframe, or another harmful action. Public URLScan records partly corroborate a historical incident because two July exact-domain scans are tagged clickfix, but accessible records do not expose the transaction, destination, sample, or payload hash. Current positive external results are domain blacklist categories rather than exact current objects. The stored Suspicious Website classification is unsupported for the current deployment. Public assets identify WordPress 7.0.3, which includes the July batch fix but is behind a later security release; updating WordPress remains required security maintenance.
Analyst findings
Review 8 documented observations View evidence
A fresh supported Gridinsoft rescan reached the expected Simply Serene Wellness and Aesthetics site through a same-host HTTP-to-HTTPS redirect and received HTTP 200. The report's current first-party site data contained no positive behavioral signal. Its broad Suspicious Website state was inherited from a July 27 signature and did not describe a current exact URL, file, payload, hash, redirect, or observed harmful action.
- Public artifact URL https://gridinsoft.com/online-virus-scanner/url/sswamn-com
-
HTTP status
200 -
Final URL
https://sswamn.com/ - Page element Simply Serene Wellness and Aesthetics
- Analyst observation The fresh public-site result did not identify a current exact malware file, payload URL, file hash, unrelated redirect, or harmful action.
Desktop, mobile, crawler, and review request profiles all received HTTP 200 from the same HTTPS apex and the expected medical-spa site. The WordPress sitemap exposed 90 current URLs; 24 representative sitemap URLs plus the homepage, contact, about, privacy, login, REST, and ordinary 404 routes were reviewed. They did not expose an unrelated redirect, executable or archive link, command-execution instruction, clipboard instruction, cryptomining script, WebSocket flow, or external credential receiver. The contact form posts to the same host, while appointment links lead to the disclosed Boulevard booking service.
-
HTTP status
200 -
Final URL
https://sswamn.com/ - Page element Simply Serene Wellness and Aesthetics
- Analyst observation Four representative request profiles converged on the same HTTPS apex and expected business surface.
- Analyst observation Ninety current URLs were discovered and 24 representative sitemap URLs were sampled without an unrelated redirect, executable or archive link, command-execution instruction, or external credential receiver.
- Analyst observation The public contact form submits to sswamn.com; the disclosed booking destination is blvd.me and www.joinblvd.com.
Current public assets identify WordPress 7.0.3. The ordinary REST index returned HTTP 200, while an unauthenticated GET to /wp-json/batch/v1 returned the WordPress rest_no_route HTTP 404 response. WordPress documents that the July REST batch-route confusion and SQL-injection chain was fixed in 7.0.2 and backported to 6.9.5, so the visible current core version is newer than that fix. WordPress 7.0.4 was subsequently released with another authenticated Author-plus security fix; the site should update to the current supported release. The prerequisites for that later issue were not tested and this version observation is not evidence that the site is currently compromised.
- Public artifact URL https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- Public artifact URL https://wordpress.org/news/2026/08/wordpress-7-0-4-release/
-
HTTP status
200 - Analyst observation The public wp-emoji asset query identifies WordPress 7.0.3.
- Analyst observation An unauthenticated GET to /wp-json/batch/v1 returned HTTP 404 with rest_no_route; no exploit attempt was made.
The retired pay.sswamn.com hostname did not resolve from two independent network vantage points. Certificate-transparency history and two public URLScan records show that the exact host existed in July and August 2023 and served a page titled Online payment at pay.sswamn.com from an Amazon address. Those records support its historical payment-portal role. They do not show a current delegated service, and the NXDOMAIN result means there is no current host content to certify or classify.
- DNS fact pay.sswamn.com returned NXDOMAIN from two independent network vantage points during the review.
- Public artifact URL https://urlscan.io/result/aab6b6a7-e012-41d8-98c5-5f299770542c/
- Public artifact URL https://urlscan.io/result/c5910226-6311-4c1f-bb53-59620da48a60/
- Page element Online payment @ pay.sswamn.com
Public URLScan search returned five parent-namespace scans: three apex scans from July 24, 27, and 28, 2026, and two historical pay-host scans from 2023. The July 24 and July 27 apex records are tagged clickfix; the first is also tagged joesandbox and the second threatfox. This is exact-domain historical context, not merely an unrelated domain blacklist label. However, the accessible search records and screenshots show the ordinary Simply Serene homepage and did not expose the tagged transaction, external destination, command, downloadable sample, or payload hash. The historical compromise claim is therefore partially corroborated, while its exact public object remains unresolved.
- Public artifact URL https://urlscan.io/result/019f95b0-6140-7385-bd6e-c7c0ffdd4169/
- Public artifact URL https://urlscan.io/result/019fa2ca-242a-759b-b89d-ec1061510267/
- Public artifact URL https://urlscan.io/result/019faa8c-ba75-73bf-94d1-f08f36a5e833/
- Analyst observation The July 24 and July 27 exact-domain records are tagged clickfix; one is also tagged joesandbox and one threatfox.
- Analyst observation The three accessible screenshots show the ordinary Simply Serene homepage and do not reveal the tagged harmful transaction or a payload.
OTX associates the apex with one large ThreatFix pulse, but the pulse contains only repeated domain indicators for sswamn.com and supplies no exact related URL, malware file, payload hash, or behavior description for this host. OTX also exposes three apex URL observations returning HTTP 200 with no Google Safe Browsing match. The fresh aggregate matrix contains 49 harmless, eight malicious, two suspicious, and 31 undetected results. The positive BitDefender, CRDF, Fortinet, G-Data, Lionic, Lumu, SOCRadar, Sophos, alphaMountain, and Certego entries are current domain-blacklist categories; they do not name a current exact malicious object.
- Public artifact URL https://otx.alienvault.com/indicator/domain/sswamn.com
- Analyst observation The OTX ThreatFix pulse contains repeated sswamn.com domain indicators but no exact related URL, file, payload hash, or behavior description for this host.
- Analyst observation Three OTX apex URL observations returned HTTP 200 with no Google Safe Browsing match.
- Analyst observation The fresh aggregate matrix is 49 harmless, eight malicious, two suspicious, and 31 undetected; all listed positives are domain-blacklist classifications.
The Internet Archive index preserves ordinary root and public-page snapshots through June 14, 2026, before the reported July compromise. It returned no successful root, www, or wildcard capture for the July 1 through September 1 incident and recovery interval. The archive therefore provides pre-incident continuity but cannot confirm the compromised content or the August cleanup. No successful pay-host snapshot was available during this review.
- Public artifact URL https://web.archive.org/web/*/https://sswamn.com/
- Analyst observation Successful ordinary-site snapshots exist through June 14, 2026, before the reported incident.
- Analyst observation The archive index returned no successful root, www, or wildcard capture for July 1 through September 1, 2026.
The review found exact-domain public records consistent with a historical ClickFix investigation, but no accessible record supplied the harmful transaction, external destination, malicious file, payload URL, command, or hash. The current live review did not reproduce a malicious redirect, command-execution prompt, automatic download, external credential receiver, harmful iframe, or other harmful action. Historical exact-domain context and current broad blacklist categories were therefore recorded as different evidence classes.
- Analyst observation No current exact malicious URL, file, payload, command, hash, credential receiver, harmful iframe, or unrelated redirect was identified.
- Analyst observation Historical exact-domain scanner tags were separated from present domain-level blacklist labels and from current observed behavior.
Scope and limitations
- The result applies to the public deployment and exact hosts and URLs reviewed at the recorded time; it does not certify future content, undisclosed paths, or private server state.
- The review did not access hosting files, WordPress administrator data, server logs, mail logs, backups, cron state, or removed artifacts, so the customer's private remediation steps and the initial intrusion vector were not independently verified.
- The public WordPress version observation comes from a versioned core asset and may reflect cached public content; no authenticated administrator check was performed.
- Public URLScan transaction detail for the tagged July records was unavailable without authentication; screenshots and search metadata were reviewed, and unavailable detail was treated as unknown rather than clean.
- The Internet Archive has no successful root, www, or wildcard capture for the July through August incident and recovery interval, so it cannot verify the compromised page or cleanup timeline.
- No form was submitted, account was used, exploit was attempted, file was executed, or private booking or payment workflow was tested.
Help protect others by sharing this page on social media! The more people who know about sswamn.com, the fewer chances they have to deceive someone else. Help others evaluate sswamn.com by sharing this page on social media!