04f581e7-da1f-4b43-b352-452121160611.filesusr.com - malicious URL scan, 14 Oct 2026
MalwareAnalyzer by Cyble scanned 04f581e7-da1f-4b43-b352-452121160611.filesusr.com and returned a malicious verdict (score 100). The page resolved to 18.67.93.129 on Amazon.com, Inc. in AU. The domain was registered 3333 days ago through GoDaddy.com, LLC. 1 domain and 1 IP were contacted. 33 malware samples communicate with this URL. This is a point-in-time observation from 14 Oct 2026; the page may have changed since.
Scan result
- Verdict: malicious (score 100) · Confidence 82%
- Scanned URL:
https://04f581e7-da1f-4b43-b352-452121160611.filesusr.com/ugd/0b46e6_f6585cd5c920478d995134440207e5cf.pdf?index=true - Domain: 04f581e7-da1f-4b43-b352-452121160611.filesusr.com · IP: 18.67.93.129 · AS16509 · AU
- Server: openresty/1.31.1.1
- HTTP status: 200 · application/pdf
- Registrar: GoDaddy.com, LLC · domain age 3333 days · created 2017-08-28
- TLS issuer: C=US, O=Let's Encrypt, CN=YR2 · valid to Jan 10 11: · subject CN=*.filesusr.com
- Scan tier: fast · observed 2026-10-14 09:21:11 UTC
Malware communicating with this URL (33)
These samples were observed contacting or being served from 04f581e7-da1f-4b43-b352-452121160611.filesusr.com, and at least one was hosted here. Each links to its full analysis.
- 69695d_f27787e89b3847d8875acf13bf1fbb31.pdf - referenced (hosted here) ·
4c6f71973770efa1bc35f87bb6d77bce· first seen 2026-08-26 - f08e01_26e02e46d7cb43e0a226deb19efa7275.pdf - referenced (hosted here) ·
eb957357f57a414af068028b9e83ac52· first seen 2026-08-27 - 3be48b_d19cd23021284b58a80f2947f4ad23c9.pdf - referenced (hosted here) ·
e6930505fbf74cfb75905b76df7113da· first seen 2026-08-27 - f08e01_e163c3fce37f46b283c5367273b81db4.pdf - referenced (hosted here) ·
b822d28a627b9decab83e145da9cb7ba· first seen 2026-08-27 - 4329d7_c67d8ccbfa9246ffbc237411fb4db236.pdf - referenced (hosted here) ·
2dffefd1b50a839b1cd418f8aaf1c276· first seen 2026-08-26 - a91264_5c8b61d818d64445b5d5bbeb1f09e2d3.pdf - referenced (hosted here) ·
ca1d22a249e3fc8f5716118b3d1eb7b6· first seen 2026-08-27 - eb6612_ea5ac250644647c5b5b345f84a7feb75.pdf - referenced (hosted here) ·
c1afd1ab7a826b175b3264c399928b32· first seen 2026-08-26 - 9df9d6_c764321f4b72419ba7e81ff15ae8197e.pdf - referenced (hosted here) ·
335baee78883cc9a0bb9778f153e0317· first seen 2026-08-26 - 0582e0_2f96afcf6e564c3e8a79cd47b484936e.pdf - referenced (hosted here) ·
07fe3755ea98f834f3d0df367b3c5c80· first seen 2026-08-28 - 0af078_dcbb2e3425524604b3f9872f6035e212.pdf - referenced (hosted here) ·
de2155236faf35aa990627f830a57339· first seen 2026-08-28 - 227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf - referenced (hosted here) ·
afe6da1a26ff95bfa78795a359d5897c· first seen 2026-08-27 - 7be1cd_931118c0320c471c81ce65c8f018f8e9.pdf - referenced (hosted here) ·
a8bd628a6090d31555ec92ddb3679e89· first seen 2026-08-28 - 7be1cd_5266a077832645a0a862ac9619afe699.pdf - referenced (hosted here) ·
0ca2d7187e2fbd5908f49b4d7a3477ad· first seen 2026-08-28 - 370021_a234f8a3ba9f4d938a2c2d08ceb2239c.pdf - referenced (hosted here) ·
599a39ca07a22ad4b9e14d3fd84b6ae9· first seen 2026-08-28 - f08e01_7066aad4ff574682a27e18d1a17d2234.pdf - referenced (hosted here) ·
b8a438ceff28a0d9d186f71a75a5fdd1· first seen 2026-08-28
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Hosts payload/config for 33 malware samples
- Grabbed file (0b46e6_f6585cd5c920478d995134440207e5cf.pdf) is known malicious in the corpus
- File download routed to the malware sandbox (0b46e6_f6585cd5c920478d995134440207e5cf.pdf)
- Valid TLS, no impersonation or off-origin credential post
- Certificate issued < 48h ago
Detected technologies
- Amazon CloudFront
Contacted infrastructure
- 18.67.93.129 - AS16509 Amazon.com, Inc. (Australia)
Files served by this page
- 0b46e6_f6585cd5c920478d995134440207e5cf.pdf ·
fe6e00451c58b490b328b06629ba5612
Observed indicators
- 04f581e7-da1f-4b43-b352-452121160611.filesusr.com
- 18.67.93.129
- https://04f581e7-da1f-4b43-b352-452121160611.filesusr.com/ugd/0b46e6_f6585cd5c920478d995134440207e5cf.pdf?index=true
Other scans of 04f581e7-da1f-4b43-b352-452121160611.filesusr.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 17 Oct 2026 - malicious
- 17 Oct 2026 - malicious
- 16 Oct 2026 - malicious
- 16 Oct 2026 - malicious
- 16 Oct 2026 - malicious
- 15 Oct 2026 - malicious
- 15 Oct 2026 - malicious
- 15 Oct 2026 - malicious
- 14 Oct 2026 - malicious
- 14 Oct 2026 - malicious
Questions about 04f581e7-da1f-4b43-b352-452121160611.filesusr.com
- Is 04f581e7-da1f-4b43-b352-452121160611.filesusr.com safe?
- No. MalwareAnalyzer scanned 04f581e7-da1f-4b43-b352-452121160611.filesusr.com on 14 Oct 2026 and returned a malicious verdict with a score of 100 out of 100. Treat it as hostile until it is re-checked.
- What malware is associated with 04f581e7-da1f-4b43-b352-452121160611.filesusr.com?
- 33 analysed samples communicate with this URL. At least one was served directly from this host.
- How was 04f581e7-da1f-4b43-b352-452121160611.filesusr.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of 04f581e7-da1f-4b43-b352-452121160611.filesusr.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan