What Gridinsoft observed on urlwatch.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20261001025031-eca63bfe
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Inconclusive
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The available public review does not establish phishing by the operator or safety of the entire rewritten-link namespace. Individual destinations require separate assessment.
Analyst findings
Review 4 documented observations View evidence
The apex, its www alias and the public endpoint returned the same application shell titled Abnormal AI. Browser inspection showed a blank root and endpoint, without a usable rewritten-link session.
-
HTTP status
200 -
Final URL
https://urlwatch.com/ -
Final URL
https://www.urlwatch.com/ - Public artifact URL https://urlwatch.com/urlwatch
- MIME type text/html
Official Abnormal AI documentation describes URL rewriting, link-protection explanations and an end-user warning page. This supports the stated product functionality, but the cited page does not name the appealed domain or validate every rewritten destination.
- Public artifact URL https://abnormal.ai/platform/whats-new/inbound-email-security-enhancements-faster-investigations-richer-insights
No exact current rewritten link and intended final destination were available for a complete destination-specific test. No current phishing payload, credential collection or malware file was independently reproduced in the reviewed live scope.
- Analyst observation A clean application shell cannot establish the safety of all customer-controlled destinations.
An interactive sandbox session recorded URLWatch and downstream fake Microsoft sign-in plus an MSI download; this does not prove an automatic redirect or the file’s malware identity. Another session reported no threats. URLQuery had no native or network IDS detections, only a DNS-feed label. Public threat-intelligence pulses came from one producer. An archived root preserved the Abnormal AI shell. These historical external observations are not a live reproduction.
- Public artifact URL https://app.any.run/tasks/42058862-2cb3-46d8-b651-df08bd6cc681
- Public artifact URL https://app.any.run/tasks/0eca13ee-5c43-4dad-bd4b-52fb94886227
- Public artifact URL https://urlquery.net/report/e68bb44a-602e-4b35-9c46-5519d03c136d
- Public artifact URL https://urlscan.io/result/019f8ef6-d0b7-771d-9c16-8d21b50080ca
- Public artifact URL https://otx.alienvault.com/indicator/domain/urlwatch.com
- Public artifact URL https://web.archive.org/web/20260722104443/https://urlwatch.com/
- Analyst observation Sandbox sessions: 2026-04-17 and 2025-12-02; URLQuery and archived root: 2026-07-22. The inspected urlscan capture had no classification. Threat-intelligence pulses shared the same producer.
Scope and limitations
- The live review covered only public roots and the endpoint without a complete rewritten-link session.
- Historical sandbox behavior is external evidence from its recorded date, not behavior reproduced in this live review.
- An exact current rewritten link and intended final destination are required to resolve the remaining object-specific question.
Help protect others by sharing this page on social media! The more people who know about urlwatch.com, the fewer chances they have to deceive someone else. Help others evaluate urlwatch.com by sharing this page on social media!