What Gridinsoft observed on Api.data-xplore.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260825212013-8f10359c
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current first-party review supports Safe for api.data-xplore.com. Three request profiles returned byte-identical HTTPS Xplore content; five public application tools presented data exploration, analysis, slide, quiz, and contact functions; all current catalog metadata and representative explorer, slide, and quiz objects were reviewed without finding impersonation, a deceptive transaction, unrelated redirect, external credential receiver, automatic download, malware URL, file, payload, or hash. The prior Scam Website category was not reproducible. A separate low-severity privacy issue remains because public catalog responses expose owner email metadata. The host also serves dynamic user-created content, so Safe describes the current reviewed state and does not certify every future object.
Analyst findings
Review 8 documented observations View evidence
Desktop, mobile, and command-line request profiles each returned HTTP 200 at the same HTTPS URL and the same 123,661-byte Xplore HTML document. The responses were byte-identical and no off-site redirect occurred.
-
HTTP status
200 -
Final URL
https://api.data-xplore.com/ - MIME type text/html
- File SHA-256 7b01d750314830c6c0842320e9dfafb27e2a903ed9d9e461a7624b94d8d8ec83
The current public tool pages returned HTTP 200 and presented an Explorer Creator, Analysis Studio, Slides Creator, Quiz Creator, and contact page. They accepted product-related CSV or Google Sheet inputs, project names, email values, and a Pro access code and called same-origin Xplore API routes. The reviewed pages did not impersonate a bank, identity provider, or unrelated service, and no automatic executable or archive download occurred. No form was submitted during the review.
-
HTTP status
200 - Page element Public tools: create_exp.html, fit.html, create_slides.html, create_quiz.html, contact.html
- Page element Contact page uses mailto:[email protected]
- Analyst observation The reviewed input fields and API calls were presented as Xplore data-platform functions and did not send credentials to an unrelated host.
Public catalogs enumerated 51 explorer records, 56 slide records, and 17 quiz records. All current metadata was checked for common phishing, credential, wallet, malware, and executable-download terms, with no match. Four representative current explorer, slide, and quiz objects returned HTTP 200 and displayed data-analysis or educational content without an unrelated redirect, credential form, or automatic download. This is a user-created content namespace, so the result remains bounded to the current enumeration and reviewed samples.
- Analyst observation Current public catalog counts: 51 explorers, 56 slides, and 17 quizzes.
- Analyst observation Metadata review found no login, password, wallet, seed phrase, bank, invoice, malware, phishing, executable-download, or Telegram lure term.
-
HTTP status
200
Unauthenticated catalog responses included owner email metadata for public explorer, slide, and quiz records. This is a current privacy and data-minimization weakness. It does not demonstrate scam, phishing, malware delivery, or compromise, but the email fields should be removed from public responses unless their publication is intentional and consented.
- Analyst observation Public catalog responses expose owner-email metadata without authentication; no email values are reproduced in this record.
The exact host resolved to 137.184.184.67 and presented a hostname-matching certificate valid from August 11 through November 9, 2026. These infrastructure facts were consistent with the served application but were not treated as proof of safety by themselves.
- DNS fact A record: 137.184.184.67
- Certificate fact Certificate SAN: api.data-xplore.com; valid 2026-08-11 through 2026-11-09
A fresh Gridinsoft-owned rescan reached the exact HTTPS host with HTTP 200. The existing Scam Website result was not accompanied by a reproduced scam transaction, impersonation, harmful redirect, external credential receiver, malware URL, automatic download, file, payload, or hash in the current first-party evidence.
-
HTTP status
200 -
Final URL
https://api.data-xplore.com/ - Analyst observation The prior broad domain category did not identify an exact harmful object that could be reproduced in the current review.
Public OSINT returned eleven urlscan records for the exact host. Successful scans from May through June 2026 rendered Xplore product pages; older scan failures supplied no malicious verdict or object. AlienVault OTX returned zero pulse references, Google Safe Browsing returned no warning, and current aggregate URL-vendor data recorded zero malicious and zero suspicious results. Wayback exposed no exact-host snapshot. Public sandbox and malware-feed searches exposed no exact-host sample. URLhaus and ThreatFox required authorization and Common Crawl was unavailable; those gaps were not treated as clean results.
- Public artifact URL https://urlscan.io/domain/api.data-xplore.com
- Public artifact URL https://otx.alienvault.com/indicator/domain/api.data-xplore.com
- Public artifact URL https://web.archive.org/web/*/api.data-xplore.com/*
- Analyst observation No public result reviewed for the exact host supplied a malicious URL, credential receiver, file, payload, redirect destination, or hash.
Norton and Avira retained adverse domain labels while Forcepoint categorized the host as information technology and the current aggregate matrix had no malicious or suspicious result. These are reputation or blacklist categories and are not a captured malicious sample. They were retained as contradictory context only.
- Analyst observation The adverse records available to this review did not identify an exact harmful object.
Scope and limitations
- The review covered the exact host, homepage, five public tool pages, all current public catalog metadata, representative explorer, slide, and quiz objects, DNS, TLS, and publicly indexed history at the recorded time.
- No form was submitted, no account or project was created, no private object was accessed, and server-side code, logs, databases, administrator accounts, and build systems were not reviewed.
- The host permits public user-created explorers, slides, and quizzes. Current enumeration and sampling cannot guarantee the content or destination of every future object.
- Public catalog responses exposed owner email metadata. The values are intentionally omitted from this public evidence record.
- URLhaus and ThreatFox required authorization and Common Crawl was unavailable. Missing coverage was recorded as a limitation, not proof of safety.
- External providers control their own labels and may continue to display adverse domain categories after the Gridinsoft decision.
Help protect others by sharing this page on social media! The more people who know about api.data-xplore.com, the fewer chances they have to deceive someone else. Help others evaluate api.data-xplore.com by sharing this page on social media!