Gridinsoft Suspicious, Phishing or Malicious: What Each Means

By Glenn Lyvers · Updated September 28, 2026 · 7 min read

A Gridinsoft “Suspicious” verdict means Gridinsoft’s reputation system has doubts about your URL but hasn’t concluded it is dangerous; “Phishing” and “Malicious” mean it has. All three can be wrong, and Gridinsoft is often the only engine on VirusTotal flagging a site, which is why so many owners end up searching for it. The way to get it removed is covered step by step in my Gridinsoft false positive report steps. This page explains what the verdicts mean, so you can tell whether you’re dealing with a false positive or a real problem before you file.

Is Gridinsoft legit, or is it a virus?

Gridinsoft is a real security company. It is a Ukrainian software firm that has been making anti-malware tools since 2003, best known for Gridinsoft Anti-Malware and Trojan Killer, and its engine was added to VirusTotal in 2020. It also runs a public online scanner and website reputation checker on its own site.

So no, Gridinsoft is not a virus, and a Gridinsoft verdict is not a scam in itself. It is also not infallible. Its URL reputation leans aggressive, and it frequently flags domains that no other engine does. Both things are true at once, and that is why the right response is to check rather than to panic or to dismiss it.

What each verdict means

Verdict	What it indicates	Typical cause on a real site
Suspicious	Low confidence: the URL has risk signals but no confirmed bad content.	New or low-reputation domain, shared IP with bad neighbours, redirect chains, a past infection that has aged, risky TLD.
Phishing	The URL is believed to impersonate a login, bank or brand to steal credentials.	A phishing kit uploaded to a hacked site, or your own login page resembling a well-known brand.
Malicious	The URL is believed to serve or lead to malware.	Injected scripts, drive-by redirects, hosted payloads.

“Suspicious” is by far the most common one people ask about, and the most likely to be a false positive. “Phishing” is the one I take most seriously on a site whose owner says they’ve changed nothing — phishing pages planted on hacked sites sit in folders the owner never opens.

What “Gridinsoft (no cloud)” means

On VirusTotal file reports you may see the engine listed as Gridinsoft (no cloud). As the name says, that is the engine running on its local detection logic without its cloud reputation lookups. It is used against files, so its verdicts — usually named detections such as a trojan family — concern something you uploaded or something served from your site, not the domain’s reputation as such. A (no cloud) hit on a file you distribute is a file problem; a URL verdict on your domain is a reputation problem. The removal request is the same form either way, but the evidence you send is different.

Why Gridinsoft is often the only engine flagging you

Most URL engines on VirusTotal act on specific evidence: a crawl that found malware, a phishing report, a listing in a shared feed. A reputation-scoring system also weighs softer signals — domain age, hosting neighbourhood, historical incidents — so it can flag a site nobody else has a complaint about. Two situations produce most lone Gridinsoft flags I see:

• Stale history. The site was hacked months ago, was cleaned, and every other vendor has since cleared it. Gridinsoft’s verdict simply hasn’t been reviewed.
• New or neighbourly domains. Brand-new domains and cheap shared hosting start with poor reputation. My guide to the newly registered domain false positive covers this in detail.

Gridinsoft sometimes appears together with ChongLuaDao, a Vietnamese anti-phishing list that also reports to VirusTotal. If both are flagging you, dispute both — the ChongLuaDao false positive removal page has that route.

Check the site before you dispute

A dispute against a site that is actually serving something bad gets refused, and it wastes the few days the review takes. Ten minutes of checking first is worth it:

1. Run the URL on VirusTotal and open the Details tab. Look at redirects and the final URL. If your homepage ends somewhere you’ve never heard of, that is your answer.
2. Load the site like a stranger. Phone, private window, arriving from a Google result. Conditional redirects deliberately skip logged-in owners — see the WordPress redirect hack.
3. Look for folders and files you didn’t create, especially HTML login pages and zip files.
4. Run my free site scanner and the blacklist checker to see whether anyone else has noticed something.
5. Check the exact URL flagged. Gridinsoft may be flagging one path, not your whole domain. The full path tells you where to look.

Getting the verdict changed

Once you’re confident the site is clean, Gridinsoft takes disputes through its incorrect-detection form. The current link, what to paste into it and typical response times are in my Gridinsoft false positive removal guide — follow that rather than older instructions you may find, some of which point to retired pages. Name the exact verdict you’re disputing, give the full flagged URL, and if the site was hacked and has since been cleaned, say so with the date. A stale verdict from the infected period is the single most common cause of a lingering Gridinsoft flag, and saying so up front helps.

After Gridinsoft updates, reanalyze the URL on VirusTotal so the report reflects it. Otherwise visitors and clients keep finding the old result.

When Gridinsoft is right

If the checks turn up a redirect, a phishing folder, or scripts you didn’t add, the verdict is correct and the job is a cleanup, not an appeal. Remove the infection and the way back in first — my reinfection guide covers what typically survives a quick fix — and then file the dispute along with every other vendor that has noticed.

If you’d rather not do that yourself, my malware removal service covers the cleanup, the hardening and the delisting requests, and the vendor removal directory lists every other route if you want to do the paperwork on your own. For a broader look at what other engines’ confidence labels mean, see VirusTotal detection labels explained.

Common questions

What does Gridinsoft Suspicious mean?

It is Gridinsoft's low-confidence reputation verdict for a URL. The site shows risk signals such as a new domain, poor hosting neighbourhood, redirects or a past incident, but nothing confirmed malicious. It is the verdict most likely to be a false positive, though you should still check the site before disputing it.

Is Gridinsoft a virus or a scam?

Neither. Gridinsoft is a Ukrainian security software company that has made anti-malware tools since 2003, and its engine has been part of VirusTotal since 2020. Its URL reputation verdicts can be aggressive and are sometimes wrong, but the company and its scanner are legitimate.

Why is Gridinsoft the only engine flagging my site on VirusTotal?

Reputation systems weigh soft signals like domain age and past incidents, so they can flag sites no other engine has a specific complaint about. The most common causes are an old verdict from a previous hack that was never reviewed, and new domains on shared hosting.

What is Gridinsoft (no cloud)?

It is the name of Gridinsoft's file-scanning engine on VirusTotal, running without cloud reputation lookups. Its verdicts concern files rather than your domain's reputation. A hit on a file you distribute or host is disputed through the same Gridinsoft form, with the file hash as evidence.

How long does Gridinsoft take to remove a false positive?

Replies usually arrive within a couple of days once a complete report is submitted through Gridinsoft's incorrect-detection form. Reports against sites that are still infected are refused, so check the site first. Afterwards, reanalyze the URL on VirusTotal to refresh the result.

Gridinsoft says Phishing. What should I check?

Look for folders and HTML files you did not create, especially fake login pages for banks, email providers or Microsoft, and for zip files containing phishing kits. Check the exact path Gridinsoft flagged. A Phishing verdict on a site whose owner changed nothing is often a planted kit.