What Gridinsoft observed on bloxchase.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260901001145-60dc9d87
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Rewards Platform — Offer-Specific Review Required
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent review did not reproduce harmful behavior on the current bloxchase.com operator surface. The apex, four request profiles, authentication entry points, and all 47 current sitemap URLs served the expected rewards-platform content without an unrelated redirect, phishing receiver, automatic download, executable or archive delivery, or exact malware object. The reviewed Roblox onboarding flow did not request a Roblox password or authentication cookie. Accessible public OSINT did not expose a specific harmful BloxChase URL, file, payload, hash, or execution trace; the remaining warning was a broad domain label. The previous broad Suspicious Website classification is therefore not supported for the reviewed root. However, authenticated third-party offers and destinations vary by account, country, device, and provider inventory and were not available for object-specific testing. The whole changing offer inventory cannot receive a domain-wide safety certification from a clean operator surface alone; any future abuse claim should identify the exact offer URL, app, download, destination, account context, and observation time.
Analyst findings
Review 8 documented observations View evidence
The HTTPS apex returned HTTP 200 and the expected BloxChase rewards-platform page. Plain HTTP and www converged on the same HTTPS apex. Desktop, mobile, search-crawler, and Gridinsoft request profiles returned the same title, response size, and normalized page structure without a profile-specific redirect or content substitution.
-
HTTP status
200 -
Final URL
https://bloxchase.com/ - Page element BloxChase - Earn Free Robux
- Analyst observation HTTP and www redirected only to the same HTTPS apex.
- Analyst observation Four request profiles returned identical normalized page structure and the same 123373-byte response size.
All 47 unique URLs published in the current root and blog sitemaps returned HTTP 200 at their requested bloxchase.com URLs. The reviewed public pages did not initiate an unrelated redirect, iframe, meta refresh, automatic download, or executable or archive delivery. Articles that discuss Roblox executor risks link to identified third-party informational resources, but the reviewed BloxChase pages did not navigate to them automatically or deliver their software.
-
HTTP status
200 - Public artifact URL https://bloxchase.com/sitemap.xml
- Public artifact URL https://bloxchase.com/blog-sitemap.xml
- Analyst observation 47 of 47 current sitemap URLs returned HTTP 200 at same-site final URLs.
- Analyst observation No reviewed public response initiated an off-site redirect, iframe, meta refresh, automatic download, executable delivery, or archive delivery.
- Analyst observation Third-party executor references appeared as ordinary editorial links in warning and explanatory articles, not as automatic navigation or software delivery.
The reviewed Roblox onboarding flow requested a public Roblox username, displayed the matching public profile for confirmation, and then required an existing BloxChase PIN or password, email login, or Google login on a new device. It did not request a Roblox password, Roblox authentication cookie, one-time code, or payment-card field. Email login and registration used same-origin forms, and protected reward and withdrawal pages redirected to the same authentication flow.
-
HTTP status
200 - Page element What is your username?
- Page element This device is not remembered yet. Use your existing BloxChase PIN/password, or choose Google/email login instead.
- Analyst observation The Roblox lookup requested only the public username and profile confirmation.
- Analyst observation No reviewed BloxChase form requested a Roblox password or Roblox security cookie.
- Analyst observation No authentication credential was submitted during the review.
The public site and legal pages describe advertiser-funded surveys, games, app tasks, and downloads from independent providers including TheoremReach, ayeT Studios, and OGAds. The available offers and destinations vary by account, country, device, and provider inventory. The protected earn and withdrawal pages required authentication, so no live offer, app download, transaction, payout, or provider destination was available for object-specific review.
-
Final URL
https://bloxchase.com/auth/login.php - Page element Choose games, apps, surveys and tasks from the providers available for your device and country.
- Page element TheoremReach, ayeT Studios, and OGAds
- Analyst observation The public pages disclose that offer availability and destinations vary by account, country, device, and provider inventory.
- Analyst observation No authenticated offerwall, app task, payout, transaction, or provider destination was tested.
The exact appealed host is the registrable apex, so exact-host and parent-domain scope are the same. The apex and www resolved through Cloudflare and converged on the HTTPS apex. Certificate-transparency records also exposed mail, webmail, and server service hosts on a separate address; each returned HTTP 200 on its own hostname during the bounded check. No reviewed host produced an unrelated redirect or malicious object.
- DNS fact bloxchase.com and www.bloxchase.com resolved through Cloudflare during the review.
- Certificate fact Current certificate records covered bloxchase.com, *.bloxchase.com, mail.bloxchase.com, webmail.bloxchase.com, and server.bloxchase.com.
- DNS fact mail.bloxchase.com, webmail.bloxchase.com, and server.bloxchase.com resolved to 85.137.248.188 during the review.
- Analyst observation The exact appealed host and registrable parent are both bloxchase.com.
The authentication responses set HttpOnly and SameSite=Lax on the session and remembered-device cookies, but did not set the Secure attribute. The reviewed HTTPS responses also did not advertise HSTS, CSP, or explicit frame restrictions. These are transport and browser-hardening opportunities; no session theft, script injection, or clickjacking exploit was attempted or observed.
- Analyst observation Authentication cookies included HttpOnly and SameSite=Lax but lacked the Secure attribute.
- Analyst observation The reviewed responses did not advertise Strict-Transport-Security, Content-Security-Policy, or X-Frame-Options.
- Analyst observation No exploit of the missing browser-hardening controls was attempted or observed.
Public URLScan search returned five public root-page records from February through August 2026, each for https://bloxchase.com/ with HTTP 200 and Cloudflare hosting; its anonymous detail endpoint was unavailable. OTX exposed no threat pulse and only two root URL observations with HTTP 200. Internet Archive returned no saved snapshot. Exact-host searches of accessible public sandbox, URL-abuse, threat-intelligence, and web indexes did not expose a specific harmful BloxChase URL, file, payload, hash, or behavior trace; unavailable and authentication-gated sources were treated as unknown rather than clean.
- Analyst observation URLScan public search listed five root-page scans dated 2026-02-04 through 2026-08-13, all with HTTP 200.
- Analyst observation OTX exposed zero threat pulses and two root URL observations with HTTP 200.
- Analyst observation Internet Archive returned no archived snapshot for bloxchase.com during the bounded query.
- Analyst observation Accessible exact-host sandbox, URL-abuse, threat-intelligence, and public web searches did not expose an exact malicious URL, file, payload, hash, or execution trace.
No exact malicious URL, phishing receiver, malware file, payload, exploit, command, file hash, automatic harmful redirect, or harmful execution trace attributable to bloxchase.com was supplied or reproduced. The remaining external warning was a broad domain blacklist label without an accessible object-level finding. A domain reputation category and an observed harmful URL or sample are different evidence classes and were not treated as interchangeable.
- Analyst observation The reviewed root, authentication flow, and 47 current public sitemap URLs did not produce an exact harmful URL, credential receiver, file, payload, hash, or execution trace.
- Analyst observation The remaining external warning identified the domain category but did not expose a concrete BloxChase URL, response, file, payload, hash, or sandbox trace.
Scope and limitations
- The review covered the public operator surface and unauthenticated authentication flow; no BloxChase credential was entered and no authenticated offerwall, survey, app task, withdrawal, transaction, or payout was tested.
- Third-party offers and destinations can vary by account, country, device, and provider inventory. Assessment of an alleged harmful offer requires the exact offer URL, app, download, destination, account context, and observation time.
- Public search, scanner, threat-intelligence, certificate, and archive indexes are incomplete; unavailable or authentication-only records were treated as unknown rather than clean.
- The exact appealed host is the registrable apex bloxchase.com, so exact-host and parent-domain scope are the same. Mail, webmail, and server service hosts were checked separately only at the DNS, TLS, and HTTP-response level.
- The result applies to the content and behavior observed at the recorded time and does not certify future content, private server code, undisclosed routes, authenticated account functions, or every third-party offer.
