What Gridinsoft observed on Usavisaconsultant.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260827213441-f2da4526
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Not used for this decision
The independent current review supports Suspicious Website, but not a malware label. The reviewed public company and policy pages consistently describe a private paid immigration-assistance service and clearly disclaim government affiliation, and no harmful download or unrelated automatic redirect was reproduced. However, the live login client contains a current successful-login path that places the entered username and password in a navigation URL, creating a concrete credential-exposure risk. The existing cautious classification is therefore retained independently of external vendor data.
Analyst findings
Review 4 documented observations View evidence
The apex redirected by HTTP 301 to the same-site www host. The homepage and eleven sampled public service, company, policy, registration, and login paths returned HTTP 200 HTML. The reviewed navigation did not initiate an executable download or an unrelated automatic redirect.
-
HTTP status
301 -
Redirect destination
https://www.usavisaconsultant.com/ - Analyst observation The reviewed homepage, About, Apply, Login, Contact, Terms, Privacy, Security, supplementary-service, visitor-visa, registration, and login endpoints returned HTML with HTTP 200 at their expected usavisaconsultant.com hosts.
- Analyst observation No specific malware file, payload, automatic executable download, harmful exact URL, or unrelated automatic redirect was identified in the reviewed public flow.
The public company and terms pages describe a paid private immigration-assistance and marketing service, identify Global Worldwide Online Marketing Limited as the operator, and repeatedly state that the service is not a United States government agency or law firm. The Apply and Login pages embed registration and account endpoints on lp.usavisaconsultant.com and login.usavisaconsultant.com.
- Page element The About page states that USA Visa Consultant is a private company and is not associated with the United States government or a visa-issuing government agency.
- Page element The Terms page states that the service is owned by Global Worldwide Online Marketing Limited, is a private marketing company, is not a law firm, and does not guarantee a visa or a Diversity Visa selection.
- Page element The Apply and Login pages embed same-registrable-domain registration and account interfaces.
The live login endpoint presented username and password inputs and loaded the current public API client. In its successful-login branch, that client constructs a navigation URL by either substituting the entered username and password into URL placeholders or appending them as URL query parameters before redirecting the top-level page.
-
HTTP status
200 - Page element The live interface contains username and password fields and a submit control.
- Analyst observation The active public API.js successful-login code assigns the entered username and password to a destination URL through [u] and [p] replacement or by appending u and p query parameters, then navigates window.top.location.href to that URL.
- Analyst observation Placing account credentials in a URL can expose them through browser history, intermediary or application logs, copied links, and referrer handling. No real account credential was entered during this review.
The reviewed apex and www hosts resolved, and the HTTPS service presented a currently valid wildcard certificate covering usavisaconsultant.com and its subdomains. This supports transport availability but does not mitigate the credential-in-URL behavior in the login client.
- DNS fact usavisaconsultant.com resolved to 163.171.213.13; www.usavisaconsultant.com resolved through www.usavisaconsultant.com.whecloud.com.
- Certificate fact The certificate covered *.usavisaconsultant.com and usavisaconsultant.com and was valid from 2026-07-09 through 2026-11-24.
Scope and limitations
- No valid customer account was used, so the post-authentication server response and final destination were not executed. The credential-exposure finding is based on the active public login client code and its successful-login branches.
- The registration, payment, contact, and authenticated workflows were not submitted; no personal, payment, or account data was entered.
- The review covered the named public pages, embedded registration and login endpoints, live client code, redirects, DNS, and TLS at the recorded time. It did not enumerate every authenticated page or future destination returned after login.
- The absence of a malware object applies to the reviewed scope and time. It is not a certification of legal, immigration, commercial, or service outcomes.
Help protect others by sharing this page on social media! The more people who know about usavisaconsultant.com, the fewer chances they have to deceive someone else. Help others evaluate usavisaconsultant.com by sharing this page on social media!