What Gridinsoft observed on Typebot.co
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260817054014-dc3a83ce
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Reported Abuse Remediated — Future Object-Specific Review Required
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
All nine public URLs supplied as the complete object list for this incident returned HTTP 404, the reviewed public source contains relevant object-blocking and workspace-suspension controls, and no specific malware file, payload, automatic download, or malicious hash was identified in the current reviewed scope. The incident-specific evidence no longer supports a broad domain-level Suspicious classification. Because typebot.co remains a user-controlled public-page platform whose complete current and future namespace cannot be enumerated, the safety of every user-created object remains inconclusive and future abuse must be assessed at the exact public URL or object level.
Analyst findings
Review 4 documented observations View evidence
The root domain returned the official Typebot service page with HTTP 200. No phishing imitation, unrelated redirect, automatic download, or specific malware payload was identified on the reviewed root page.
-
HTTP status
200 -
Final URL
https://typebot.co/ - Analyst observation No specific malware file, payload, malicious hash, credential-harvesting imitation, automatic download, or unrelated redirect was identified on the reviewed root page.
All nine public Typebot paths supplied by the operator as the complete object list for this incident returned HTTP 404 during the current review.
-
HTTP status
404 -
Final URL
https://typebot.co/funil-tiktok-wh5kmk5 -
Final URL
https://typebot.co/resolvebrasil1 -
Final URL
https://typebot.co/dimas -
Final URL
https://typebot.co/topazwinnmacn -
Final URL
https://typebot.co/desafiorosario -
Final URL
https://typebot.co/rosa-do-deserto-lfgtx15 -
Final URL
https://typebot.co/upsell-tonico-do-gengibre -
Final URL
https://typebot.co/dreamnc-rw9i2ug -
Final URL
https://typebot.co/002-hubness-solu-es-financeiras-e-cons-rcios-yo7891i - Analyst observation Each listed URL returned HTTP 404 without resolving to active public content. No specific malware file, payload, or malicious hash was available at these paths during the review.
The reviewed public Typebot source contains separate controls for blocking a public Typebot and suspending a workspace.
- Public artifact URL https://github.com/baptisteArno/typebot.io/blob/main/packages/scripts/src/blockTypebot.ts
- Public artifact URL https://github.com/baptisteArno/typebot.io/blob/main/packages/scripts/src/suspendWorkspace.ts
- Analyst observation The blockTypebot script deletes the matching published public snapshot and raises the object's risk level.
- Analyst observation The suspendWorkspace script sets the selected workspace to a suspended state while retaining the workspace record.
Typebot remains a user-controlled public-page platform. Confirming remediation for the complete incident list does not enumerate or certify every current or future user-created public object.
- Analyst observation The supplied list resolves the prior incident-specific evidence gap: all nine identified objects were checked individually and were unavailable.
- Analyst observation The broader public identifier namespace is not publicly enumerable, so any future suspected abuse requires review of the exact public URL or object.
Scope and limitations
- The review covered the operator root, all nine public URLs supplied as the complete object list for this incident, their current HTTP responses, and the linked public blocking and suspension scripts.
- The operator identified the supplied URLs as the complete list for this incident; Gridinsoft verified the current response of each URL but did not access private customer records to independently reconstruct the operator's complete historical incident inventory.
- No account was created, no credentials or personal data were submitted, and private workspaces, administrative systems, unpublished objects, and deleted historical content were not accessed.
- The result confirms remediation for the identified incident objects and removal of an unsupported broad detection; it does not certify all current or future user-generated content on typebot.co.
Help protect others by sharing this page on social media! The more people who know about typebot.co, the fewer chances they have to deceive someone else. Help others evaluate typebot.co by sharing this page on social media!