What Gridinsoft observed on Api.intellect.studio
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260901182111-94e693f1
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current first-party review supports Safe for api.intellect.studio. The exact host behaved as a restricted application API: the root consistently returned 403, HTTP upgraded only to the same HTTPS host, and /health returned expected JSON. Sampled public paths did not expose impersonation, credential collection, an unrelated redirect, automatic download, executable, archive, malware URL, file, payload, or hash. The previous Suspicious Website result came from a broad parent-domain signature without a current Gridinsoft-owned harmful behavior signal. External CRDF, Seclookup, Avira, and Norton labels remain contradictory context, not object-level evidence, and did not determine the verdict.
Analyst findings
Review 5 documented observations View evidence
Desktop, mobile, and crawler requests to the API root consistently returned HTTP 403 without redirecting elsewhere. HTTP upgraded once to the same HTTPS host. The public health endpoint returned HTTP 200 with the JSON result true, consistent with a restricted application API rather than a conventional public homepage.
-
HTTP status
403 -
Final URL
https://api.intellect.studio/ -
HTTP status
200 - Public artifact URL https://api.intellect.studio/health
- Analyst observation The /health response was application/json with the body {"result":true}.
The standard public status, documentation, and security-text paths reviewed either returned the same site's normal HTTP 404 response or the expected health JSON. No path redirected off-site, presented an impersonated login, requested credentials or payment, or initiated an automatic executable or archive download.
- Analyst observation /health returned 200 JSON; /healthz, /status, /.well-known/security.txt, /openapi.json, /swagger, and /docs returned same-site 404 responses.
- Analyst observation No reviewed public path exposed a password form, file-upload form, payment request, unrelated redirect, automatic download, executable, or archive.
The exact host resolved through the same Cloudflare deployment as the parent and presented a hostname-matching wildcard certificate. These infrastructure facts are consistent with the stated company-controlled API but were not treated as safety proof by themselves.
- DNS fact A records: 104.21.90.30 and 172.67.193.197
- Certificate fact Certificate SANs: intellect.studio and *.intellect.studio; valid 2026-07-29 through 2026-10-27
- Analyst observation The exact API host and the parent used the same Cloudflare addresses and certificate scope during the review.
A fresh supported Gridinsoft rescan reached the exact HTTPS host and retained Suspicious Website from the broad intellect.studio signature dated July 6, 2026. The current first-party report contained no positive harmful-behavior signal and identified no exact malicious path, response, redirect destination, file, payload, or hash. The aggregate snapshot contained 53 harmless, two malicious blacklist labels, and 35 undetected results.
-
HTTP status
403 -
Final URL
https://api.intellect.studio/ - Analyst observation The retained signature named intellect.studio and was dated 2026-07-06; no current positive harmful-behavior signal accompanied it.
- Analyst observation Fresh aggregate snapshot: 53 harmless, 2 malicious, 0 suspicious, and 35 undetected.
- Analyst observation The two adverse aggregate entries were CRDF and Seclookup hostname blacklist labels.
Exact-host public OSINT returned zero URLScan records, zero OTX threat pulses and URL observations, and zero successful Wayback records. Exact public web searches and OpenPhish did not expose a harmful API URL or sample. Certificate history corroborated the parent-controlled wildcard deployment. URLhaus and ThreatFox required authorization, and Common Crawl was unavailable; those gaps were treated as unknown.
- Public artifact URL https://urlscan.io/domain/api.intellect.studio
- Public artifact URL https://otx.alienvault.com/indicator/hostname/api.intellect.studio
- Public artifact URL https://web.archive.org/web/*/api.intellect.studio/*
- Analyst observation URLScan, OTX, and Wayback returned no exact-host record exposing a malicious object.
- Analyst observation No accessible exact-host search supplied a malicious URL, response, file, payload, hash, credential receiver, or execution trace.
Scope and limitations
- The review covered the exact API host, root response, public health endpoint, standard public status and documentation paths, redirects, DNS, TLS, and accessible public OSINT at the recorded time.
- No authenticated application request, private API method, customer account, mobile-app session, server-side code, log, database, administrator access, or unpublished route was tested.
- The restricted root and absent public API documentation limit functional coverage. Safe describes the reviewed public behavior and does not certify private data handling or every authenticated endpoint.
- URLhaus and ThreatFox required authorization and Common Crawl was unavailable. Missing coverage was recorded as unknown, not as a clean result.
- External providers control their own hostname or domain labels and may continue to display an adverse result after the Gridinsoft decision.
Help protect others by sharing this page on social media! The more people who know about api.intellect.studio, the fewer chances they have to deceive someone else. Help others evaluate api.intellect.studio by sharing this page on social media!