What Gridinsoft observed on Weecnetwork.org
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260824193017-c20346da
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The Suspicious Website classification is retained because the current public deployment serves an obfuscated loader across multiple pages. The loader contacts a separate host and is designed to execute remotely supplied JavaScript in visitors' browsers.
Analyst findings
Review 5 documented observations View evidence
The root host served the expected WEEC Network page content together with an obfuscated inline script. The www host redirected to the same root deployment.
-
HTTP status
403 -
Final URL
https://weecnetwork.org/ -
Redirect destination
https://weecnetwork.org/ - DNS fact weecnetwork.org resolved to 86.107.36.146; www.weecnetwork.org was an alias of the root host.
The same 23,144-byte obfuscated inline loader was served on twelve sampled public pages, including the homepage, organization pages, conference pages, partners page, and newsletter page.
- File SHA-256 0e5be0cc5c0c73d8ff691e89f8a84623a36000cb0790a4cfabf09d269869d5f1
- Analyst observation The identical loader was present on /, /about/, /charter-of-principles/, /board-and-past-socio-scientific-committees/, /secretary-general/, /permanent-secretariat/, /world-environmental-education-day/, /virtual-conference/, /congress/, /no-limits-to-hope/, /partners/, and /newsletter/.
Isolated static analysis showed that the loader collects browser state, sends encrypted POST requests to forecast-chaos.com, decrypts the response, parses it as JSON, and executes JavaScript supplied in the response. This permits remote code to run in a visitor's browser.
- Public artifact URL https://forecast-chaos.com/x9i32md/w1/la02
- Public artifact URL https://forecast-chaos.com/x9i32md/w1/uf3j
- Public artifact URL https://forecast-chaos.com/x9i32md/w1/sci5
- Analyst observation The code was decoded in an isolated environment with network access replaced by a local capture function; no response from the remote service was executed.
No specific downloaded file, second-stage payload, or payload hash was retrieved during this review. The directly observed harmful object is the active inline loader and its remote-code execution path, not a preserved executable sample.
- Analyst observation The review did not send the loader's encrypted POST requests to the remote host and did not execute any returned code.
A current Gridinsoft rescan completed and the public deployment continued to serve the reviewed site while the active classification remained Suspicious Website.
-
HTTP status
403 -
Final URL
https://weecnetwork.org/
Scope and limitations
- The review covered the current public deployment and twelve representative public pages; private server files, administrator accounts, deployment history, scheduled tasks, and logs were not available.
- The remote service was not contacted with the loader's encrypted request and no returned code was executed, so this review does not identify a specific second-stage file, payload hash, or final user-visible lure.
- The review establishes the current loader behavior but does not attribute who placed it on the site or determine the initial access method.
Help protect others by sharing this page on social media! The more people who know about weecnetwork.org, the fewer chances they have to deceive someone else. Help others evaluate weecnetwork.org by sharing this page on social media!