What Gridinsoft observed on t3s.top
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20261028061117-9dfdc49a
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Inconclusive
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The public review identified unsafe credential persistence that needs correction before clearance. It did not reproduce phishing or malware delivery and does not establish the original classification cause.
Analyst findings
Review 3 documented observations View evidence
The public site presents a VR ELO leaderboard. Its login and registration forms request accounts for T3S and submit to the same origin. No form was submitted.
-
HTTP status
200 -
Final URL
https://t3s.top/index.php
The login page loads login_remember.js.php. Its submit handler writes the username and raw password to localStorage, then restores them for a saved-account login. This behavior is visible in the served code; it was not tested with credentials.
-
HTTP status
200 -
Final URL
https://t3s.top/lib/login_remember.js.php
A 29 November 2021 archived root page contains unrelated Korean escort advertising and template links. It differs from the current leaderboard and does not establish current compromise or continuous ownership.
-
HTTP status
200 - Public artifact URL https://web.archive.org/web/20211129121909id_/http://t3s.top/
Scope and limitations
- No credentials, account creation, private data, server-side handling or exploitation were tested. The www content, complete site history and continuous ownership were not established. A .top-only classification cause and any dependency of Spectrum’s block on Gridinsoft were not verified.
Help protect others by sharing this page on social media! The more people who know about t3s.top, the fewer chances they have to deceive someone else. Help others evaluate t3s.top by sharing this page on social media!