What Gridinsoft observed on d3tool.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20261029001713-ce95d464
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The current public d3tool.com website and its www alias showed a coherent dental-software service without reproduced ClickFix, phishing or malware delivery. The current site review supports clearance of the domain warning within this scope. Historical incident context and contrary external warnings remain relevant; this is not certification of installers, private systems or continuous historical safety.
Analyst findings
Review 6 documented observations View evidence
The apex and www serve the same D3Splint 2 dental-design application. The product, login, FAQ, privacy, terms and contact pages were reviewed without submitting data or purchasing. No fake verification prompt, command-execution instruction, phishing impersonation or malware delivery was reproduced in this public scope.
- Public artifact URL https://d3tool.com/
- Public artifact URL https://www.d3tool.com/
- Public artifact URL https://d3tool.com/d3splint-2
- Public artifact URL https://d3tool.com/login
- Public artifact URL https://d3tool.com/faq
- Public artifact URL https://d3tool.com/privacy
- Public artifact URL https://d3tool.com/terms
- Public artifact URL https://d3tool.com/contact
The reviewed JavaScript sends account requests to same-origin API paths and restricts checkout destinations to Stripe or the same origin. Its clipboard action copies a private confirmation link, not a shell command. These observations do not establish what private server code does.
- Public artifact URL https://d3tool.com/assets/index-C5-Eg_r4.js
Current apex and www DNS resolve through Cloudflare; HTTP roots lead to HTTPS and advertise HSTS. SPF includes Proton only; design.d3tool.com returns NXDOMAIN. The paths /wp-login.php, /wp-json/, /product/D3Splint/ and /uk-free-bingo/ return the current application shell, not WordPress content; the last path was also observed returning to the homepage in the browser. This supports a changed public deployment, without proving the entire backend was cleaned.
- Public artifact URL https://d3tool.com/.well-known/security.txt
- Public artifact URL https://d3tool.com/wp-login.php
- Public artifact URL https://d3tool.com/wp-json/
- Public artifact URL https://d3tool.com/uk-free-bingo/
The public ClickFix domain list still includes d3tool.com. OTX returns 38 March 2026 pulses, largely repeated automated domain indicators; its malware response contains no file samples. Older OTX URL records associate apex and www with a different address in December 2025. These are dated external associations, not independent reproductions of a payload, command or present infection.
- Public artifact URL https://gist.github.com/cdup07/9f563dfb78a06fad5db794f33ba93a3f
- Public artifact URL https://otx.alienvault.com/indicator/domain/d3tool.com
The reviewed urlscan search, limited to 30 days, returned five October records. October 25 entries for www, /product/D3Splint/ and /uk-free-bingo/ identify the D3Splint 2 page on Cloudflare. Search metadata alone does not expose executable malware or prove safety. Exact-domain public-index searches did not yield a verified downloadable malicious sample for this review; this is not proof that none exists. The challenged host is already the registrable parent domain.
- Public artifact URL https://urlscan.io/result/01a1749d-cdeb-727b-a42c-d957c0bb675c/
- Public artifact URL https://urlscan.io/result/01a1749d-4a48-75bf-adf8-72155e490380/
Blender Conference 2019 independently links D3Tool and dental modelling to d3tool.com, supporting historical business context but not uninterrupted ownership. Wayback metadata identifies a January 21, 2026 capture; its contents were not established in this review. Neither the original infection mechanism nor the claimed expiry of ThreatFox IOC 1757536 was independently verified.
- Public artifact URL https://conference.blender.org/2019/presentations/513/
- Public artifact URL https://web.archive.org/web/20260121160405/https://d3tool.com/
Scope and limitations
- No purchase, account login, private download, installer execution or update-signature verification was performed.
- Cloudflare delivery and public code do not prove use of Workers throughout, removal of every old server file, all SendGrid DNS records or the exact cleanup dates.
- The original cause of the earlier warning and a complete historical compromise/remediation sequence were not established. Archive metadata is not a reviewed page capture.
- Point-in-time public checks cannot exclude conditional delivery, unseen pages or future compromise. No medical effectiveness, fulfillment or refund outcome is certified.
Help protect others by sharing this page on social media! The more people who know about d3tool.com, the fewer chances they have to deceive someone else. Help others evaluate d3tool.com by sharing this page on social media!