What Gridinsoft observed on Joinrubymd.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260827220842-d68bc385
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent first-party review supports the Safe category for the reviewed public deployment of joinrubymd.com. The apex, www entry, 17 sitemap routes, redirects, appointment-page source, DNS, TLS, and repeated direct requests did not reproduce phishing, credential theft, an unrelated automatic redirect, an automatic harmful download, malware delivery, or another malicious object. The customer's rebrand and service-provider explanation was materially confirmed by the site's current terms and disclosures. Medication-related marketing remains visible, but it is not a reproducible security basis for the prior broad Suspicious Website classification.
Analyst findings
Review 7 documented observations View evidence
The HTTPS homepage and all 17 URLs listed in the current sitemap were reviewed. All 18 reviewed pages returned HTTP 200 after redirects and served coherent RubyMD telehealth-infrastructure, clinic-launch, booking, training, case-study, or testimonial content. One sitemap entry, /replay-page, redirected only to the same-site /replay2 route. No reviewed entry point produced an unrelated automatic redirect, automatic executable or archive download, credential imitation, or malware-delivery instruction.
-
HTTP status
200 -
Final URL
https://joinrubymd.com/ - Page element Title: RubyMD - Start a Telehealth Business in 30 Days | 100 Clinics Built
- Analyst observation The root plus 17 sitemap URLs were reviewed; every page returned HTTP 200 after redirects, and no automatic off-domain redirect or executable or archive download was reproduced.
HTTP apex, HTTP www, and HTTPS www entry points converged on https://joinrubymd.com/. Repeated direct requests to the HTTPS homepage returned the same final URL and identical response content. No destination changed by request repetition or between the reviewed apex and www entry points.
-
Redirect destination
https://joinrubymd.com/ -
HTTP status
200 - Analyst observation The only observed entry redirects normalized HTTP and www requests to the same HTTPS apex; repeated homepage requests returned identical content.
The current terms page, dated July 18, 2026, identifies the operator as Emberflow LLC doing business as RubyMD at joinrubymd.com. Current public pages also link to emberflowai.com, while the privacy page still uses the Emberflow name. The reviewed homepage describes RubyMD as providing administrative, technology, operational, marketing, clinical-network, pharmacy-integration, compliance, and payment infrastructure for telehealth clinic operators. This first-party content supports the claimed rebrand and service-provider relationship.
-
HTTP status
200 -
Final URL
https://joinrubymd.com/terms - Page element Terms identify Emberflow LLC d/b/a joinrubymd.com as RubyMD.
- Analyst observation Current RubyMD pages link to www.emberflowai.com, and the privacy page retains the Emberflow operator name.
The homepage explicitly states that RubyMD provides administrative, technology, and operational services; medical services are delivered by independent professional corporations and licensed providers; compounded medications are not FDA-approved and are dispensed only against a valid prescription. The same page also contains marketing copy about launching peptide, GLP-1, and HRT clinics and calls its funnel the best way to sell those treatment categories. The reviewed content therefore markets infrastructure for medication-related clinics but does not by itself establish that RubyMD directly dispenses medication or that the domain is malicious.
- Page element RubyMD provides administrative, technology and operational services.
- Page element Medical services are delivered by independent professional corporations and their licensed providers.
- Page element Compounded medications are not FDA-approved and are dispensed only against a valid prescription from a licensed provider.
- Analyst observation The homepage also advertises clinic infrastructure for GLP-1, peptide, and HRT programs; those marketing references are distinct from observed malware or phishing behavior.
The reviewed /apply and /booking source configured appointment-calendar components and ordinary telephone-input support through the site's LeadConnector platform. The served public markup did not expose a password, one-time-code, wallet-recovery, seed-phrase, private-key, executable-upload, or automatic-download flow. No appointment, inquiry, payment, medical intake, or other form was submitted during the review.
-
Final URL
https://joinrubymd.com/apply - Page element Appointment-calendar configuration and telephone-input support
- Analyst observation No password, one-time-code, recovery-secret, private-key, executable-upload, or automatic-download flow was identified in the reviewed public source; no form was submitted.
The apex and www hosts resolved through Cloudflare delivery addresses and served the reviewed site. The apex certificate named joinrubymd.com and the www certificate named www.joinrubymd.com; both were issued by Google Trust Services and were valid for the current review period. Shared delivery addresses were treated as infrastructure facts, not as evidence about the private origin or a malicious payload.
- DNS fact joinrubymd.com resolved to 162.159.140.166; www.joinrubymd.com resolved to 104.18.35.90 and 172.64.152.166.
- Certificate fact Apex certificate: joinrubymd.com, valid 2026-08-12 through 2026-11-10; www certificate: www.joinrubymd.com, valid 2026-08-12 through 2026-11-10.
- Analyst observation Both HTTPS entry points served the expected RubyMD site through shared Cloudflare delivery infrastructure.
A fresh supported Gridinsoft scan reached the expected HTTPS homepage with HTTP 200. Before correction, the Suspicious Website result remained attached to a stored broad domain signature, while the current report listed no positive behavioral signal and supplied no exact malicious URL, phishing receiver, executable, archive, payload, or hash. Direct review of the current public deployment did not reproduce a first-party basis for retaining that broad warning.
-
HTTP status
200 - Public artifact URL https://gridinsoft.com/online-virus-scanner/url/joinrubymd-com
- Analyst observation The fresh Gridinsoft report contained no current positive behavioral signal and did not identify a specific malicious URL, receiver, file, payload, or hash.
Scope and limitations
- The verdict applies to the public apex, www entry point, current sitemap pages, and public source reviewed at the recorded time; it does not guarantee future or newly added content.
- No customer supplied an exact malicious URL, file, payload, hash, screenshot, or transaction for object-specific reproduction.
- The review did not authenticate to private clinic, patient, provider, pharmacy, administrative, billing, or advertising accounts and did not enumerate private, unlinked, parameter-dependent, or newly created routes.
- Appointment and inquiry configuration was inspected but no form was submitted; no payment, medical intake, prescription, account, or checkout workflow was completed.
- The review did not verify medical licensure, pharmacy sourcing, HIPAA, LegitScript, advertising, revenue, testimonial, clinical, or legal claims and is not a medical, regulatory, privacy, or business-performance certification.
Help protect others by sharing this page on social media! The more people who know about joinrubymd.com, the fewer chances they have to deceive someone else. Help others evaluate joinrubymd.com by sharing this page on social media!