What Gridinsoft observed on Surveymethods.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260828051552-502ea6cd
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Survey Platform — Exact Survey URL Review Required
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent current review did not reproduce phishing or malware behavior on the surveymethods.com operator surface and did not identify a specific malicious survey URL, credential receiver, executable, payload, or hash. The apex and www host serve a long-running online-survey business, while app and regional hosts support changing customer-created surveys and forms. The current external phishing entries are domain- or hostname-blacklist labels without a disclosed exact harmful object. A domain-wide Safe certification is therefore not supported because the complete customer-content namespace cannot be enumerated; the appropriate first-party conclusion is inconclusive, with exact survey URL and destination review required. This distinguishes the absence of a reproduced malicious sample from the existence of broader domain reputation warnings.
Analyst findings
Review 8 documented observations View evidence
The current Gridinsoft report presented surveymethods.com as Safe from a manual override dated July 2025. Fresh report data reached the expected survey-software homepage, recorded only a same-site HTTP-to-HTTPS redirect, and did not identify an exact phishing form, unrelated redirect, automatic download, malware file, payload, exploit, command, receiver, or hash. The same report separately retained two current phishing results whose method was domain blacklist.
- Public artifact URL https://gridinsoft.com/online-virus-scanner/url/surveymethods-com
-
HTTP status
200 -
Final URL
https://surveymethods.com/ - Analyst observation The current first-party report did not name a concrete harmful surveymethods.com URL, destination, file, payload, receiver, command, exploit, or hash.
Plain HTTP redirected once to the HTTPS apex, and www redirected to the same apex. The homepage, Security page, and Privacy Policy returned HTTP 200 and consistently described a commercial online-survey platform. The reviewed operator pages did not submit an automatic download, request a wallet or seed phrase, display a failed-delivery or urgent-verification lure, or redirect navigation to an unrelated host.
-
HTTP status
200 -
Final URL
https://surveymethods.com/ - Public artifact URL https://surveymethods.com/security/
- Public artifact URL https://surveymethods.com/privacy-policy/
- Page element SurveyMethods – Online Survey Software | Data Analysis
- Analyst observation No unrelated automatic redirect, automatic executable or archive download, wallet request, seed-phrase request, failed-delivery lure, or urgent-verification prompt was reproduced on the reviewed operator pages.
SurveyMethods exposes a separate application and user-content surface. The app entry redirected to the service's same-site authentication host, the public contact page exposed an expected CAPTCHA-protected support form, and a publicly indexed survey object returned its branded survey title plus a closed-survey message. A regional public survey route returned the SurveyMethods application shell. These samples did not deliver malware or an unrelated redirect, but they demonstrate that customers can publish distinct forms and survey content under SurveyMethods-controlled hostnames.
-
Redirect destination
https://us.auth.surveymethods.com/login - Public artifact URL https://app.surveymethods.com/contact/
- Page element The reviewed indexed survey returned a closed-survey notice and did not expose a password, payment, or download field.
- Analyst observation The public application supports customer-authored survey objects and forms on platform hostnames; the finite checked sample cannot represent every current, private, expired, or future survey.
The public urlscan.io index returned 459 results for the registrable domain and 349 results for app.surveymethods.com. Recent and historical examples included the operator homepage, authentication pages, regional survey routes, and many separately titled customer surveys. The index establishes a large changing user-content namespace; the number of scans is not a count of malicious verdicts, and the reviewed records did not supply a specific malware payload or credential receiver for the appealed apex host.
- Public artifact URL https://urlscan.io/domain/surveymethods.com
- Public artifact URL https://urlscan.io/result/019a16b6-2bcf-74cd-bca1-66de01742329/
- Public artifact URL https://urlscan.io/result/019eaa74-2763-718c-a12d-e845d85605b8/
- Analyst observation The index exposed hundreds of separately titled survey objects and platform routes; it did not make the 459 domain matches equivalent to 459 harmful findings.
Current external context remained mixed. The Gridinsoft report's VirusTotal snapshot contained 57 harmless, two malicious, and 31 undetected engines; both adverse entries were phishing results with blacklist method. OTX contained a January 2026 domain indicator for surveymethods.com and a 2023 hostname indicator for app.surveymethods.com, but neither pulse supplied an exact path, captured response, credential receiver, file, payload, or hash. Current OpenPhish, URLhaus recent, and ThreatFox full public feeds had no exact match. Exact public sandbox-index searches did not surface a sample-level result.
- Public artifact URL https://otx.alienvault.com/indicator/domain/surveymethods.com
- Public artifact URL https://otx.alienvault.com/indicator/hostname/app.surveymethods.com
- Analyst observation The two current VirusTotal adverse entries were domain-blacklist labels, not sample-level behavior reports.
- Analyst observation The reviewed OTX pulses named only the domain or hostname and did not include an exact harmful URL, response, credential receiver, file, payload, or hash.
- Analyst observation No exact surveymethods.com match was present in the current OpenPhish feed, URLhaus recent public feed, or ThreatFox full public export at the review time.
The Internet Archive CDX index returned 560 distinct successful apex or www captures spanning July 2006 through June 2026. The latest reviewed snapshot presented the same SurveyMethods online-survey software business and title as the current operator site. This supports long-running operator continuity, but archive coverage cannot enumerate private, expired, unindexed, or future customer survey URLs.
- Public artifact URL https://web.archive.org/web/20260604155939id_/https://surveymethods.com/
- Page element SurveyMethods – Online Survey Software | Data Analysis
- Analyst observation The exact-root archive index contained 560 distinct HTTP 200 captures from 2006 through 2026.
The apex and www operator site resolved through Amazon CloudFront, app.surveymethods.com resolved separately to Microsoft-hosted infrastructure, the authentication hostname used Auth0, and the regional application used Azure. Valid certificates matched each reviewed hostname. These facts confirm distinct platform components and transport identity; they do not certify the content of every customer-created survey.
- DNS fact surveymethods.com resolved to CloudFront addresses; www.surveymethods.com used the d3pxppyyimvyq6.cloudfront.net alias.
- DNS fact app.surveymethods.com resolved to 20.64.106.66; us.auth.surveymethods.com used Auth0 and Cloudflare; uk.surveymethods.com used Azure App Service.
- Certificate fact The Amazon certificate for surveymethods.com and www.surveymethods.com was valid from 2026-01-07 through 2027-02-05.
- Certificate fact The reviewed app, authentication, and regional hosts each presented a currently valid matching certificate.
No specific malware file, executable, archive, payload URL, payload hash, credential receiver, or reproducible phishing workflow was identified on the reviewed operator pages or finite public survey sample. The unresolved risk is the changing user-controlled survey namespace together with domain-only external warnings, not an observed malicious payload served by the apex.
- Analyst observation No exact malicious URL, malware file, executable, archive, payload, hash, credential receiver, or reproducible phishing flow was identified in the reviewed scope.
Scope and limitations
- The appealed host is the registrable parent domain, so exact-host and parent-domain OSINT refer to the same surveymethods.com apex. The www alias and relevant app, authentication, and regional hosts were reviewed separately.
- The review covered the current Gridinsoft report, apex and www navigation, Security and Privacy pages, the application entry, the public contact form, two public survey routes, DNS, TLS, public URL indexes, threat-intelligence context, phishing feeds, sandbox-search indexes, and archive history.
- No account was created, no credential or personal information was submitted, and no private, invitation-only, expired, or account-bound survey was accessed beyond its public response.
- The complete current, private, expired, deleted, unindexed, geographic, account-bound, and future customer survey namespace is not publicly enumerable. The checked sample cannot certify every survey object.
- The reviewed regional application required JavaScript for full rendering. No claim is made about content that was not returned to the reviewed request profile.
- Public search, urlscan, OTX, archive, feed, and sandbox indexes are finite. Absence from an index does not prove that no unindexed historical abuse ever existed.
- External blacklist labels remain independently controlled context. They are not equivalent to a current reproducible malicious URL or sample and did not determine the first-party verdict.
- The verdict does not certify every current or future survey as safe and is not a guarantee against later customer-created abuse or content changes.
Help protect others by sharing this page on social media! The more people who know about surveymethods.com, the fewer chances they have to deceive someone else. Help others evaluate surveymethods.com by sharing this page on social media!