What Gridinsoft observed on Supertrader.me
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260824011145-d4ca74f3
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent current review supports Safe for supertrader.me. Fresh first-party rescans and exact-host HTTP and browser checks found a consistent trading-journal service, a normal bodyless www-to-apex redirect, the same content across ordinary and scanner-labelled clients, and no exact phishing URL, impersonated service, off-site credential receiver, malicious redirect, malware download, payload, or hash. Public URL scanners, threat-intelligence sources, search indexes, and archives retained several provider-controlled domain labels but supplied no reproducible malicious object. CERT Polska's exact domain entry had already been unblocked and removed from its active list. Those blacklist categories are contradictory reputation context, not equivalent to a real sample with observed harmful behavior, and were insufficient to retain the unsupported Gridinsoft classification. The operator-identity inconsistency is documented as a low-severity transparency issue and does not change the behavioral verdict.
Analyst findings
Review 4 documented observations View evidence
Fresh Gridinsoft rescans and independent HTTP review found no exact malicious URL, impersonated service, off-site credential receiver, malicious redirect, malware file, payload, or hash. The exact www host returned a bodyless 301 to the apex; browser, Googlebot, Bingbot, and VirusTotal-labelled requests then received the same substantive 200 response and identical body, so no user-agent cloaking was reproduced.
-
HTTP status
200 -
Redirect destination
https://supertrader.me/ - File SHA-256 1716765e8e926e199e93d8ff9a3ac641e5dea70326da6d3001c31e19fb67c326
- Analyst observation The decompressed apex HTML was 1023039 bytes and identical across all four reviewed user-agent labels.
- Certificate fact The current Amazon certificate covers supertrader.me and wildcard subdomains and is valid from 2026-06-09 through 2026-12-23.
A JavaScript-capable browser rendered the current site as a trading-journal and analytics service. The public application displayed its own sign-in and registration surface plus Google and Apple OAuth options. Reviewed public pages, scripts, policy links, store links, and same-origin API references exposed no unrelated destination, automatically delivered executable or archive, hidden frame, or off-site credential receiver. No form or account data was submitted.
-
Final URL
https://app.supertrader.me/auth - Page element Welcome back | Sign in to your SuperTrader account
- Public artifact URL https://supertrader.me/about
- Public artifact URL https://supertrader.me/terms
- Analyst observation The reviewed application bundle referenced the same-origin API at https://app.supertrader.me/api and ordinary trading-journal, broker-import, OAuth, and checkout functions.
Public OSINT found contradictory domain labels but no exact malicious sample. urlscan had nine public results for apex, www, and staging hosts without a public malicious verdict in the search records. OTX linked one broad CERT.PL pulse but listed no malware relation and its reviewed URL records had no Google Safe Browsing match. The exact CERT Polska action log shows supertrader.me blocked on 2026-08-10 and unblocked on 2026-08-16; it is absent from the current active list. Current VirusTotal context was 57 harmless, 2 malicious blacklist labels, 1 suspicious blacklist label, and 30 undetected.
- Public artifact URL https://urlscan.io/domain/supertrader.me
- Public artifact URL https://otx.alienvault.com/indicator/domain/supertrader.me
- Public artifact URL https://cert.pl/lista-ostrzezen/
- Public artifact URL https://www.virustotal.com/gui/domain/supertrader.me
- Analyst observation Cluster25 and CRDF labelled the domain malicious and ESET labelled it suspicious using blacklist methods; those were domain categories rather than exact URL, file, payload, hash, receiver, or observed behavior evidence.
- Analyst observation URLhaus and ThreatFox public API responses required authentication during this review, so unavailable responses were not treated as clean results.
Public indexes and archives showed continuity of the same SuperTrader product rather than an unrelated malicious deployment. Wayback returned 571 collapsed records from 2025-04 through 2026-06; sampled pages presented the trading journal and same-site application navigation. The latest Common Crawl index returned 1784 successful records across the parent and subdomains, with sampled current pages consistent with the same product. No exact malicious object was found in the sampled snapshots.
- Public artifact URL https://web.archive.org/web/20250409050808id_/https://supertrader.me/
- Public artifact URL https://index.commoncrawl.org/
- Analyst observation The earliest sampled Wayback root snapshot was dated 2025-04-09 and displayed SuperTrader trading-journal content.
- Analyst observation A sampled 2025 broker page kept sign-up and login navigation on app.supertrader.me; no off-site receiver or malware download was observed.
Scope and limitations
- The verdict applies to the publicly reachable apex, www, public application sign-in surface, and sampled pages at the recorded time; it is not a guarantee about future content.
- The review did not create an account, submit login or broker data, complete OAuth, initiate payment, install a mobile application, or inspect authenticated account features.
- Private source code, server files, databases, logs, administrative sessions, broker integrations, and unpublished routes were not audited.
- No exact historical malicious URL, preserved file, payload, or hash was supplied for retrospective analysis; none was inferred from a domain blacklist category.
- URLhaus and ThreatFox API responses were unavailable without authentication and therefore were not treated as clean findings.
- External provider labels and update schedules are separately controlled contradictory context and were not used to determine the current Gridinsoft verdict.
Help protect others by sharing this page on social media! The more people who know about supertrader.me, the fewer chances they have to deceive someone else. Help others evaluate supertrader.me by sharing this page on social media!