What Gridinsoft observed on todoodledos.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260903173740-ee75046e
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The current public website implements a creator job, payment and invoice tracking application. The reviewed routes, forms, client scripts, redirects and linked data service did not reproduce phishing impersonation, credential relay to an unrelated origin, a malicious redirect, an automatic harmful download, or a malware payload. No current exact harmful URL, file or hash was identified. The prior broad Suspicious Website classification was unsupported by current first-party behavior and was corrected to Safe; external domain-level warnings remain separately controlled contradictory context.
Analyst findings
Review 7 documented observations View evidence
The HTTP root redirected once to the HTTPS root on the same domain and returned the expected TodoodleDos application landing page. The www host also redirected once to the same HTTPS root; no unrelated destination was observed.
-
HTTP status
200 -
Final URL
https://todoodledos.com/ -
Redirect destination
https://todoodledos.com/ - Analyst observation Both tested host variants converged on the same first-party HTTPS page without an external redirect.
The public site consistently presented a creator and freelancer job, payment and invoice tracking application. The reviewed landing, login, privacy-policy, terms-and-conditions and invoice routes matched that declared purpose and exposed a same-domain support address.
- Page element Landing page: Every job. Every payment. One dashboard.
- Page element Public routes reviewed: /login, /privacy-policy, /terms-and-conditions and /invoice.
- Analyst observation No MetaMask, wallet, seed phrase, cryptocurrency, unrelated brand-login or urgent account-verification content appeared in the reviewed public pages.
Review of the current application entry script and its route modules found same-site navigation, Firebase authentication and storage services disclosed by the site's own policies, Google analytics resources, and an invoice PDF generator invoked by the user. No credential relay to an unrelated site, automatic download, or malware-delivery path was identified.
- Analyst observation The login module passes email and password to the configured Firebase authentication SDK rather than to an unrelated web origin.
- Analyst observation The invoice route builds a PDF locally only after the user selects Download PDF; it does not initiate an automatic executable or archive download.
- Analyst observation No public delegated page, file, redirect or tenant namespace was identified in the reviewed route and script inventory.
The application's linked Firebase Realtime Database rejected an unauthenticated root read. The public login route remained on todoodledos.com and used the configured Firebase authentication flow.
-
HTTP status
401 - Analyst observation The unauthenticated database response was Permission denied.
-
Final URL
https://todoodledos.com/login
Three browser and crawler user-agent profiles received the same successful final URL, content type and page bytes, and three additional root requests remained on the same HTTPS destination. No conditional redirect or changing destination was reproduced.
-
HTTP status
200 - MIME type text/html; charset=UTF-8
- File SHA-256 7a61ff3893ad2fbf36f7061ff563e4cb272127f83fd4c3226fc2274f108f821d
- Analyst observation The compared responses did not vary by the tested user-agent profile.
Current DNS and certificate observations matched the site's Netlify deployment: the root resolved to Netlify edge addresses, www used the declared Netlify hostname, and the presented certificate covered todoodledos.com and www.todoodledos.com.
- DNS fact todoodledos.com resolved to 75.2.60.5 and 99.83.231.61.
- DNS fact www.todoodledos.com used todoodledos-pro.netlify.app.
- Certificate fact The active certificate included todoodledos.com and www.todoodledos.com and was valid through 2026-11-13.
The available public URLScan capture from 2026-08-15 showed the TodoodleDos login page at the submitted root URL. Its stored page record reported a successful same-domain HTTPS page and score 0; it did not identify a specific malware file, payload, URL or hash.
- Public artifact URL https://urlscan.io/result/01a006cf-9deb-72d8-810a-dc83e149d53e/
- Screenshot SHA-256 d0fc5429708a99020738c68d261b2afba22b405ae58c91f2748a1b2d09af7bd5
- Analyst observation The stored screenshot showed a generic Welcome Back email-and-password form for the same job-management application, not a cryptocurrency-wallet or unrelated brand page.
Scope and limitations
- The review covers the public routes, responses and downloadable client code available at the recorded time; it did not access or certify private customer account contents.
- No public user-controlled or delegated content namespace was identified in the reviewed application routes. A future exact URL or object that is not present in the reviewed surface would require its own current review.
- External blacklist entries may remain under their publishers' control. Their presence is recorded as context, not as proof that a current exact harmful object was reproduced.
