What Gridinsoft observed on sandstonefx.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260825212213-fce6b775
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The current public scope supports a Suspicious Website verdict because a high-risk CFD service offers credential-taking registration across EU and UK jurisdictions while expressly disclaiming regulation and consumer protection there. The reviewed evidence does not support calling the current site Phishing or Malware: no impersonated login, unrelated credential receiver, malware file, payload, hash, or automatic download was reproduced.
Analyst findings
Review 6 documented observations View evidence
The apex and www HTTPS URLs returned the same SandStoneFX CFD marketing site. HTTP upgraded to the matching HTTPS host, and no unrelated redirect, iframe, or automatic download was observed on the reviewed marketing pages.
-
HTTP status
200 -
Final URL
https://sandstonefx.com/ -
Final URL
https://www.sandstonefx.com/ -
Redirect destination
https://sandstonefx.com/ -
Redirect destination
https://www.sandstonefx.com/
The marketing site openly advertises leveraged CFD trading, account tiers, and links to the same-brand trading application. It also states that the service is licensed in Mauritius but is not regulated by a financial authority in the EU or UK and does not provide EU or UK consumer-protection frameworks.
- Page element Sign Up and Log In links point to trade.sandstonefx.com.
- Page element The page states that the service is not regulated by an EU or UK financial authority.
- Page element The page advertises CFD accounts starting from EUR 200.
The trading host loaded a same-brand login application with email and password fields. The reviewed flow did not redirect credentials to an unrelated public hostname, and no impersonated third-party brand was observed.
-
Final URL
https://trade.sandstonefx.com/login - Page element Email and password fields are present on the SandStoneFX login page.
- Analyst observation No unrelated credential receiver was identified in the reviewed unauthenticated flow.
The public registration application requests name, email, password, country, phone number, and acceptance of legal documents. Its selectable countries include EU states, the United Kingdom, and the United States; no region-specific block was displayed before account creation in the reviewed flow.
- Page element Registration requests name, email, password, country, and phone number.
- Page element Germany, United Kingdom, and United States are selectable country values.
- Analyst observation The reviewed pre-submission form displayed no region-specific authorization check or blocking notice.
Public archive captures show a placeholder page in January 2025 and the SandStoneFX marketing site with links to the trading application by October 2025. Captures continue through June 2026. No public archive capture was available for the exact trade host or its login path.
- Analyst observation The archived root changed from a placeholder in January 2025 to the current trading brand during 2025.
- Analyst observation Archived marketing pages linked to trade.sandstonefx.com by October 2025.
- Analyst observation No archived capture was returned for trade.sandstonefx.com or trade.sandstonefx.com/login.
The reviewed public pages, unauthenticated login and registration flow, scripts, and redirects did not identify a specific malware file, payload, hash, automatic download, or unrelated phishing receiver.
- Analyst observation No specific malware file, payload, URL, or hash was identified.
- Analyst observation No automatic executable download or unrelated credential receiver was reproduced.
Scope and limitations
- No customer credentials were entered and no account was created, so authenticated trading, deposit, withdrawal, KYC, and post-login behavior were not tested.
- The exact trade host had no public archive capture, limiting historical comparison of the trading application.
- This verdict applies to the public URLs, forms, scripts, redirects, and historical captures reviewed at the recorded time.
Help protect others by sharing this page on social media! The more people who know about sandstonefx.com, the fewer chances they have to deceive someone else. Help others evaluate sandstonefx.com by sharing this page on social media!