What Gridinsoft observed on Gexmonitor.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260825044038-d1b2d355
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The current public apex and www application serve same-origin cryptocurrency-options analytics. The claimed external affiliate path is absent, the only root redirect is same-host HTTPS normalization, and no current phishing receiver, credential-stealing flow, wallet-secret request, malicious download, payload, or harmful exact URL was reproduced. Remaining external blacklist categories are contradictory reputation context rather than a current object-level basis for Phishing, so the current Gridinsoft Phishing classification is unsupported for the reviewed public scope.
Analyst findings
Review 6 documented observations View evidence
The submitted host is the registrable apex domain itself, so there is no separate parent domain below .com. HTTP redirected once to the same host over HTTPS, the apex returned HTTP 200, and www.gexmonitor.com returned the same current application without an unrelated destination.
-
HTTP status
200 -
Final URL
https://gexmonitor.com/ -
Redirect destination
https://gexmonitor.com/ - DNS fact gexmonitor.com and www.gexmonitor.com resolved through Cloudflare during the review.
- Certificate fact The presented certificate covered gexmonitor.com and *.gexmonitor.com and was valid at the review time.
All 19 URLs published in the current sitemap returned HTTP 200 and remained on gexmonitor.com. The reviewed pages presented cryptocurrency-options analytics for BTC, ETH, and SOL, API documentation, company information, contact details, and policy pages.
- Public artifact URL https://gexmonitor.com/sitemap.xml
- Page element The sitemap listed 19 same-origin market overview, analytics, chain, activity, expiry-impact, and vega-exposure pages.
- Analyst observation The homepage, About, Contact, Privacy Policy, Terms of Service, Disclaimer, and API Docs pages returned expected first-party content.
- Analyst observation No reviewed public page initiated an unrelated redirect, automatic file download, executable delivery, or browser-extension installation.
The customer-identified affiliate redirect path /go/deribit currently returns HTTP 404 and does not redirect. The current public pages link to internal analytics routes and a YouTube profile; the reviewed application code uses same-origin APIs and the official Deribit public market-data API rather than an external affiliate hop.
-
HTTP status
404 - Public artifact URL https://gexmonitor.com/go/deribit
- Analyst observation The current root response did not contain a /go/deribit link or another /go/ redirect target.
- Analyst observation Client code contains Whop analytics and referral attribution, but the reviewed flow did not redirect the visitor to Whop or another unrelated site.
The reviewed login implementation is an account sign-in and registration flow for the GEX Monitor application using email/password and OAuth through its configured authentication provider. The reviewed public pages and application scripts did not request a wallet connection, seed phrase, recovery phrase, private key, or unrelated service password.
- Public artifact URL https://gexmonitor.com/login
- Page element The login client submits email/password authentication through the configured application authentication client and returns to a same-origin path.
- Analyst observation Wallet-related text found in a shared JavaScript chunk was the name of a generic icon and unused authentication-library support code, not a wallet prompt in the reviewed GEX Monitor pages.
- Analyst observation No seed-phrase, recovery-phrase, private-key, wallet-drainer, impersonated-brand login, or automatic-download behavior was identified in the reviewed current surface.
Public OSINT searches found no URLScan result, no Wayback snapshot for the apex, www alias, or /go/deribit path, no OTX pulse or malware object, and no indexed public sandbox sample for the exact host. OTX contained three domain URL observations, and their recorded Safe Browsing result contained no match.
- Analyst observation URLScan public search returned zero results for domain:gexmonitor.com.
- Analyst observation Wayback availability and CDX queries returned no archived snapshot for https://gexmonitor.com/, https://www.gexmonitor.com/, or https://gexmonitor.com/go/deribit.
- Analyst observation AlienVault OTX returned zero pulses and zero malware objects for gexmonitor.com; its three URL records showed no Safe Browsing match.
- Analyst observation Exact-name searches in the public indexes of ANY.RUN, Hybrid Analysis, Triage, and Joe Sandbox did not identify an object-level sample.
- Analyst observation The absence of a public indexed sample does not prove that the domain had no historical issue; it means no exact archived or sandbox object was available to reproduce the historical redirect claim.
The current review did not identify a phishing receiver, impersonated login target, credential-collection URL, malware file, executable payload, harmful download URL, crypto drainer, or file hash on the reviewed apex and www surface.
- Analyst observation The remaining external detections are broad domain blacklist categories and did not provide a current exact URL or sample whose harmful behavior reproduced on the reviewed site.
Scope and limitations
- The review covers the current public apex, www alias, all sitemap URLs, linked public pages, the login implementation, current scripts, the reported /go/deribit path, and certificate-transparency-disclosed host liveness at the recorded time; it does not certify future content changes or undisclosed unlinked paths.
- No customer-supplied malicious file, payload, hash, phishing receiver, or harmful exact URL beyond the reported root and former /go/deribit route was available for object-level analysis.
- Public archives contained no snapshot of the reported historical redirect flow, so this review confirms its current absence but cannot independently reconstruct the earlier 302 response.
- The Safe verdict describes the reviewed current public web scope; it does not alter independently controlled external provider records or guarantee the behavior of future authenticated sessions and changes.
Help protect others by sharing this page on social media! The more people who know about gexmonitor.com, the fewer chances they have to deceive someone else. Help others evaluate gexmonitor.com by sharing this page on social media!