What Gridinsoft observed on Cruwijn.nl
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260826202804-aef1bbdc
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context — not used for this decision
The independent Gridinsoft-owned review found the expected long-running Cruwijn wine retailer on the registered domain and its www alias and did not reproduce phishing, malware delivery, credential theft, malicious redirection, cloaking, automatic file delivery, or a specific harmful object. Remaining external results were broad domain blacklist or reputation categories without an identified malicious sample or URL and did not control this verdict. Safe applies to the current public scope reviewed at the recorded time.
Analyst findings
Review 7 documented observations View evidence
The registered domain returned HTTP 200 over HTTPS. The www alias redirected once to the same HTTPS apex. Desktop, mobile, and crawler user agents reached the same wine retailer homepage; no unrelated destination, user-agent cloaking, or automatic download was reproduced.
-
HTTP status
200 -
Final URL
https://cruwijn.nl/ -
Redirect destination
https://cruwijn.nl/ - Page element Title: Cruwijn | Winkel en webwinkel voor wijn en gedistilleerd in Roden
- Analyst observation Desktop, mobile, and crawler request profiles returned the same site purpose and did not redirect to an unrelated host.
The homepage, contact page, webshop, representative product, account page, cart, and empty checkout path all returned expected Cruwijn and WooCommerce content. Navigation, forms, and reviewed scripts remained on the disclosed store or ordinary supporting services; no phishing receiver, unrelated checkout, executable delivery, or concealed credential collection was observed.
- Public artifact URL https://cruwijn.nl/contact/
- Public artifact URL https://cruwijn.nl/webshop/
- Public artifact URL https://cruwijn.nl/mijn-account/
- Public artifact URL https://cruwijn.nl/winkelwagen/
- Public artifact URL https://cruwijn.nl/winkel/de-roner-krudenlikeur-0-35cl/
- Analyst observation The reviewed login and cart forms were same-origin WooCommerce flows. No credentials, order, payment data, or contact-form data was submitted.
- Analyst observation No executable file, forced download, unrelated redirect, iframe, or unexpected form action was found in the reviewed public flow.
The public WordPress sitemap exposed ordinary store, product, policy, blog, test, and imported demo pages. Representative business pages and several stale test or demo entries returned the same Cruwijn theme and same-origin resources. The stale entries are maintenance hygiene, but the review did not reproduce malicious redirection, payload delivery, or unrelated content from them.
- Public artifact URL https://cruwijn.nl/wp-sitemap.xml
- Public artifact URL https://cruwijn.nl/test/
- Public artifact URL https://cruwijn.nl/test-banner/
- Public artifact URL https://cruwijn.nl/instagram-demo-customizer/
- Analyst observation Representative sitemap pages served the same site identity and ordinary WordPress or WooCommerce resources.
- Analyst observation The public inventory contained stale test and demo pages, but none of the reviewed entries produced a harmful object or unrelated destination.
The apex resolved to 149.210.191.142 and www was a CNAME to the apex. A currently valid certificate covered cruwijn.nl and www.cruwijn.nl, and the reviewed DNS and redirect paths converged on the same HTTPS store.
- DNS fact cruwijn.nl A 149.210.191.142
- DNS fact www.cruwijn.nl CNAME cruwijn.nl
- DNS fact Nameservers: ns3.firstfind.nl, ns4.firstfind.nl, ns5.firstfind.net
- Certificate fact Let's Encrypt certificate covering cruwijn.nl and www.cruwijn.nl, valid from 2026-08-19T07:33:27Z through 2026-11-17T07:33:26Z
- Analyst observation No reviewed DNS or redirect path led to an unrelated site.
The exact reported host is the registered domain itself, so exact-host and parent-domain scope coincide; the www alias was checked separately. Public search results described the long-running Roden retailer. URLScan contained public captures of the apex, www redirect, and store pages without a published malicious verdict. OTX contained no pulses and four indexed URLs with no Google Safe Browsing match. No public exact URL or sample was identified as the object behind the current domain blacklist categories.
- Public artifact URL https://urlscan.io/domain/cruwijn.nl
- Public artifact URL https://otx.alienvault.com/indicator/domain/cruwijn.nl
- Public artifact URL https://rdap.sidn.nl/domain/cruwijn.nl
- Analyst observation URLScan returned 14 domain-query records, including expected apex, www, and store pages on 149.210.191.142; the available search records did not publish a malicious verdict.
- Analyst observation OTX returned zero pulses for cruwijn.nl and www.cruwijn.nl. Its four apex URL records showed no Google Safe Browsing matches.
- Analyst observation Current URLhaus and ThreatFox direct interfaces required authentication, so no completeness claim is made for those sources.
- Analyst observation Current external detections were domain-level blacklist or reputation categories and did not identify an object-level URL, file, hash, payload, receiver, or reproduced harmful action.
The domain has been registered since November 2011. Public archive captures showed the www host serving Cruwijn content from September 2013 and the apex serving the same wine-store purpose through April 2026. The representative April 2026 snapshot used the same business identity, navigation, products, contact routes, and same-origin WordPress or WooCommerce resources seen live. The archive review did not identify a captured malware URL or payload.
- Public artifact URL https://web.archive.org/web/20130904021749id_/http://www.cruwijn.nl/
- Public artifact URL https://web.archive.org/web/20260413043847id_/https://cruwijn.nl/
- Public artifact URL https://rdap.sidn.nl/domain/cruwijn.nl
- Analyst observation SIDN RDAP records registration on 2011-11-09 and active status at review time.
- Analyst observation Representative successful archived HTML captures dated from 2013 through 2026 presented the Cruwijn wine retail business rather than an unrelated campaign.
- Analyst observation The archive index is incomplete and does not prove that every historical URL was safe; no captured harmful object was identified in the reviewed snapshots.
The review covered the current public apex, www alias, representative store and account flows, visible forms, scripts and destinations, DNS, TLS, public URL-scanner and threat-intelligence indexes, and representative archive captures. It did not authenticate to private intelligence, complete a purchase, submit forms, enumerate every undisclosed path, or certify future content.
- Analyst observation No credentials, personal data, order, payment information, or form message was submitted during the review.
- Analyst observation Public OSINT and archive coverage is incomplete; absence of a public object does not prove that an undisclosed historical object could never have existed.
- Analyst observation The Safe result is limited to the current reviewed public scope and is not a certification of every undisclosed URL, private area, or future change.
Scope and limitations
- The verdict applies to the current public apex, www alias, and representative public store, account, contact, product, cart, sitemap, DNS, TLS, and archive scope reviewed at the recorded time; it does not certify undisclosed paths, private services, or future content.
- Forms and commerce flows were inspected without submitting credentials, contact data, orders, or payment information. No authenticated area or private intelligence source was tested.
- Public search, sandbox, threat-intelligence, URL-scanner, and archive indexes are incomplete. No matching public malicious object means none was found in the reviewed sources, not that an undisclosed historical object could never have existed.
Help protect others by sharing this page on social media! The more people who know about cruwijn.nl, the fewer chances they have to deceive someone else. Help others evaluate cruwijn.nl by sharing this page on social media!