What Gridinsoft observed on Urunler.rezexproof.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260824204915-437c6c80
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only โ not used for this decision
The exact product host still serves active injected SEO-spam and hidden gambling backlinks in fresh responses. The current evidence supports Suspicious Website rather than Phishing: harmful content injection is directly observable, but a credential-theft flow or specific malware payload was not reproduced.
Analyst findings
Review 4 documented observations View evidence
The exact host returned HTTP 200 and extensive injected gambling and backlink content. Many links were placed in off-screen absolute-positioned elements with large negative left offsets.
-
HTTP status
200 -
Final URL
https://urunler.rezexproof.com/ - Page element Repeated casino, 1xBet, and Mostbet text appeared alongside links to numerous unrelated external domains.
- Page element Hidden backlink blocks used position:absolute with large negative left offsets.
A cache-busting request returned a fresh Cloudflare cache miss and still contained the injected content, with more than 200 absolute-positioned link blocks. The observed compromise was therefore not limited to a stale cached copy.
-
HTTP status
200 -
Final URL
https://urunler.rezexproof.com/ - Analyst observation Fresh cache-miss HTML retained repeated casino, 1xBet, and Mostbet text and extensive hidden outbound links.
The reviewed responses did not present a password-entry form, impersonated login, unrelated redirect, or automatic file download. Three indexed spam article paths returned HTTP 404 at review time.
- Analyst observation No password input or credential-collection form was identified in the reviewed homepage HTML.
- Analyst observation No specific malware file, payload, URL, or hash was identified in the reviewed flow.
-
HTTP status
404
The reviewed March 2026 archive snapshot showed the established product site and did not contain the casino, 1xBet, or Mostbet text present in the current homepage.
- Public artifact URL https://web.archive.org/web/20260331082408/https://urunler.rezexproof.com/
- Analyst observation The historical homepage did not reproduce the current injected gambling terms.
Scope and limitations
- The review covered the public homepage, three indexed spam paths, redirect behavior, forms, DNS, and selected archive snapshots; it did not inspect the host filesystem or WordPress database.
- The external destinations were identified as outbound links but were not executed beyond the reviewed exact-host flow.
Help protect others by sharing this page on social media! The more people who know about urunler.rezexproof.com, the fewer chances they have to deceive someone else. Help others evaluate urunler.rezexproof.com by sharing this page on social media!