Independent Gridinsoft analysis
What Gridinsoft observed on winterwonderlandnorwich.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
Current review
Review ID
GMA-20261019182509-b49c69e5
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Event website with external code loader
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The existing Suspicious warning is retained because of this specifically observed public code. The overall assessment remains inconclusive. Ordinary event content does not negate the loader; external warnings are separate context.
Analyst findings
Review 1 documented observation View evidence
Firefox displayed the Christmas event and its dedicated See Tickets page. The current public front-probe.js script in plugin site-helper-a2cad165eaf0 loads program text from a blockchain contract, executes it through new Function and can create a persistent full-screen frame.
- Public artifact URL https://winterwonderlandnorwich.com/
- Public artifact URL https://www.winterwonderlandnorwich.com/
- Public artifact URL https://winterwonderlandnorwich.com/wp-content/plugins/site-helper-a2cad165eaf0/assets/front-probe.js
- Public artifact URL https://winterwonderlandnorwich.seetickets.com/tour/winter-wonderland-norwich
- Public artifact URL https://find-and-update.company-information.service.gov.uk/company/10664804
Scope and limitations
- Code functions were read statically, not executed as malware. Current blockchain-contract content was not confirmed; neither a malicious payload nor an actually displayed overlay was established. No tickets ordered, payments or forms submitted; no complete server cleanup certified.
Help protect others by sharing this page on social media! The more people who know about winterwonderlandnorwich.com, the fewer chances they have to deceive someone else. Help others evaluate winterwonderlandnorwich.com by sharing this page on social media!