What Gridinsoft observed on Glavior.ai
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260821224459-b23a3d55
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current first-party review supports a Safe classification for glavior.ai within the reviewed public scope. A fresh Gridinsoft scan retained only the stored July 2026 Phishing signature, with no positive current signal or exact malicious object. Four user-agent profiles received identical production HTML; the described hidden ticker and pricing block was absent; and the reviewed root, security dossier, dashboard, marketplace gate, authentication UI, redirects, selected scripts, DNS, and TLS did not reproduce impersonation, credential theft, a malicious redirect, or executable or archive delivery. Dossier inaccuracies and external warnings remain separately recorded limitations and contradictory context; they did not determine this verdict.
Analyst findings
Review 6 documented observations View evidence
A fresh Gridinsoft scan retained Phishing solely through an active apex-domain signature dated 2026-07-30. The current raw report recorded no positive first-party signal and did not identify an exact malicious object or behavior.
- Analyst observation The fresh raw report recorded positive_signals as an empty array.
- Analyst observation The selected signature was the broad glavior.ai fishing signature dated 2026-07-30T01:00:08.901000.
- Analyst observation The current Gridinsoft-owned report did not name a specific phishing URL, impersonated brand, credential receiver, malicious redirect, file, archive, payload, exploit, or malware hash.
Desktop, mobile, Googlebot, and curl request profiles each received the same 50,838-byte HTTPS document. The current source contained ordinary product metadata, JSON-LD, and two short noscript fallbacks, but the previously described non-visible ticker, exchange-price, and crawler-keyword block was not present. No user-agent-specific content difference or off-site redirect was reproduced.
-
HTTP status
200 -
Final URL
https://glavior.ai/ - File SHA-256 674df5ca520e47fd777ed44456738c055f4e8345a0991c4aaa93b06e2c527676
- Analyst observation All four request profiles returned byte-identical response bodies.
- Analyst observation No hidden 1-pixel element, display:none keyword block, invisible exchange-price list, meta refresh, form, iframe, or same-origin executable or archive link was present in the reviewed root HTML.
Browser-rendered review covered the root, both /verifysafety and /verify-safety dossier routes, the public dashboard, and the marketplace route. The dossier rendered on both spelling variants; the dashboard displayed Glavior-branded market information; and the marketplace route was access-restricted rather than exposing public seller objects. No route produced an unrelated destination, embedded frame, automatic download, or phishing impersonation.
- Page element Platform Security Findings, Remediation & Vendor Clearance
- Page element Trading Dashboard
- Page element Marketplace: This module is restricted to Glavior administrators.
- Analyst observation No reviewed route contained an iframe or an executable, archive, application-package, or other automatic download link.
The account control offered Glavior-branded Google, Telegram, and email authentication. The email option exposed a same-origin email and password form, while reviewed wallet code used standard wallet-provider and message-signing interfaces. Selected authentication, wallet, exchange-connection, execution, and checkout bundles contained no seed-phrase or private-key input request. No login, wallet connection, signature, exchange connection, payment, or transaction was submitted.
- Page element Continue with Google; Continue with Telegram; Continue with Email
- Page element Same-origin email input and current-password input
- Analyst observation Static review covered the current authentication, wallet modal, EVM, Solana, Sui, TON, KuCoin connection, trade-execution, and checkout bundles.
- Analyst observation The selected current flow bundles contained no seed phrase, mnemonic, private-key input, exchange-password input, or 2FA-secret input string.
- Analyst observation Wallet and exchange integrations referenced standard provider connections, WalletConnect, OAuth, and signed-message or transaction APIs rather than a cloned third-party login page.
HTTP redirected once to the same-site HTTPS origin. The apex and www hosts were served through Cloudflare, and the apex presented a valid Google Trust Services certificate for glavior.ai. The observed response enforced HSTS for one year with includeSubDomains and returned nosniff and strict-origin-when-cross-origin headers.
-
Redirect destination
https://glavior.ai/ - DNS fact The observed apex A and AAAA responses were Cloudflare anycast addresses; authoritative nameservers were ridge.ns.cloudflare.com and kimora.ns.cloudflare.com.
- Certificate fact Google Trust Services WE1 certificate for glavior.ai, valid from 2026-08-19T23:52:08Z through 2026-11-18T00:52:01Z.
- Analyst observation Observed headers included strict-transport-security: max-age=31536000; includeSubDomains, x-content-type-options: nosniff, and referrer-policy: strict-origin-when-cross-origin.
The customer-published dossier was useful for selecting checks but was not accepted as proof by itself. Several claims did not exactly match the observed production state: the response HSTS value was one year without preload rather than the displayed two years with preload; no CSP or Permissions-Policy response header was observed; DMARC was p=none rather than p=reject; and the public account flow included email and password authentication. These are documentation and hardening discrepancies, not reproduced phishing behavior.
- Analyst observation The dossier displayed max-age=63072000; includeSubDomains; preload, while the response header was max-age=31536000; includeSubDomains.
- DNS fact The observed _dmarc.glavior.ai TXT record was v=DMARC1; p=none; pct=100; rua=mailto:[email protected].
- Analyst observation The public account flow offered an email and password option, so the dossier's broad no-password wording could not be independently confirmed.
- Analyst observation Private server configuration, API-permission enforcement, encrypted storage, and backend credential handling were not accessible in this public review.
Scope and limitations
- The verdict applies to the public root, both dossier routes, dashboard, marketplace access gate, account UI, redirect behavior, selected current client bundles, DNS, and TLS reviewed at the recorded time; future content or deployments require a new review.
- No account was created, no login credentials were submitted, no wallet was connected, no message or transaction was signed, no exchange was connected, and no payment or order was submitted.
- Private server configuration, databases, API-permission enforcement, secret storage, encrypted vault behavior, authenticated account data, unpublished routes, and the requester's private remediation records were not inspected.
- The review confirms that the described hidden block is absent from the current production response; it does not independently reconstruct the previous build or prove how the build pipeline was changed.
- The dossier's HSTS, CSP or Permissions-Policy, DMARC, and password-handling statements were not fully consistent with observed production behavior and should be corrected; these discrepancies were not evidence of phishing in the reviewed flow.
- The domain is a young financial and cryptocurrency service, and current external warnings remain separately controlled contradictory context; they did not control the independent Gridinsoft verdict.
- No specific malware file, phishing payload, malicious URL, exploit, or hash was found or is claimed by this review.
Help protect others by sharing this page on social media! The more people who know about glavior.ai, the fewer chances they have to deceive someone else. Help others evaluate glavior.ai by sharing this page on social media!