1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com - malicious URL scan, 16 Oct 2026
MalwareAnalyzer by Cyble scanned 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com and returned a malicious verdict (score 100). The page resolved to 18.67.93.129 on Amazon.com, Inc. in AU. The domain was registered 3335 days ago through GoDaddy.com, LLC. 1 domain and 1 IP were contacted. 17 malware samples communicate with this URL. This is a point-in-time observation from 16 Oct 2026; the page may have changed since.
Scan result
- Verdict: malicious (score 100) · Confidence 80%
- Scanned URL:
https://1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com/ugd/227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf?index=true - Domain: 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com · IP: 18.67.93.129 · AS16509 · AU
- Server: openresty/1.31.1.1
- HTTP status: 200 · application/pdf
- Registrar: GoDaddy.com, LLC · domain age 3335 days · created 2017-08-28
- Scan tier: fast · observed 2026-10-16 07:44:08 UTC
Malware communicating with this URL (17)
These samples were observed contacting or being served from 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com, and at least one was hosted here. Each links to its full analysis.
- b90ba1_9329497b1f2b41f8902c4d90e5759253.pdf - referenced (hosted here) ·
f60a725eb93c758d3584a4bd8f4e24e2· first seen 2026-08-26 - 035627_c19c9c78b8524fa48c607185abee6824.pdf - referenced (hosted here) ·
7ae1edd9d13baa3160ace3f13b1ea776· first seen 2026-08-27 - e948c1_6478a49573dc47ae9fc6883ac43b2425.pdf - referenced (hosted here) ·
2af31e440238f325d8fc5e4ae37bf4d4· first seen 2026-08-27 - 5bb01c_a97c4ea240344867b53b20342ad334d3.pdf - referenced (hosted here) ·
ea041233bf5fc6ad5b6e53a9be4f79ca· first seen 2026-08-27 - 49f5ef_c8ae5d7891c241699639d69a5c6e7e4e.pdf - referenced (hosted here) ·
ff12920cf1078bffb05a1034735df451· first seen 2026-08-27 - f08e01_328b91c2448e4abc88b32fcbd6221717.pdf - referenced (hosted here) ·
d77d313877119e4b4ff29102d5020b1d· first seen 2026-08-26 - d2759c_0239ec17caac40eea3501f62fb3c3fba.pdf - referenced (hosted here) ·
cba3f5f26275efd8011e6b8b620d0111· first seen 2026-08-27 - bdc04d_dc53d7475a874a76a2fc5578ad7f819d.pdf - referenced (hosted here) ·
e9b62c81600363674a233613b1d8ccee· first seen 2026-09-05 - 2994dd_86c305efd77e469e9b1a3fa8eb26320a.pdf - referenced (hosted here) ·
f52b57da57d6b7137c2f751c58e43003· first seen 2026-08-29 - f2ef67_cbd0c19fadad49ccb1be6a3466a0b016.pdf - referenced (hosted here) ·
05bc8e56e22a3711b77b59d8dea1260c· first seen 2026-08-28 - 227d0f_0cb1115f5ba54c7d8906894ab24b497a.pdf - referenced (hosted here) ·
a0e074fa8e33c5e69cef73b7e9aee305· first seen 2026-10-08 - 8ba634_b52b1bcb9581494a8fa81b4424e20298.pdf - referenced (hosted here) ·
88d9cf8ebb46da151857814917a54d1f· first seen 2026-08-28 - dc8a8e_5f3b6f216a884b0ca6a2acff190d9713.pdf - referenced (hosted here) ·
f0031ab53075acb33999b9e356c6bb34· first seen 2026-09-10 - 9cfd0a_9851e8eadf2c4d2aab22efac4df8c2c0.pdf - referenced (hosted here) ·
9ef36f64bbb44c8146d5a202d823cc17· first seen 2026-08-29 - 440e29_ccd527c357924342a127137e3a0925dd.pdf - referenced (hosted here) ·
94416920940664eb4f7358a9a469693a· first seen 2026-09-07
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Hosts payload/config for 17 malware samples
- Grabbed file (227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf) is known malicious in the corpus
- File download routed to the malware sandbox (227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf)
Detected technologies
- Amazon CloudFront
Contacted infrastructure
- 18.67.93.129 - AS16509 Amazon.com, Inc. (Australia)
Files served by this page
- 227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf ·
afe6da1a26ff95bfa78795a359d5897c
Observed indicators
- 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com
- 18.67.93.129
- https://1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com/ugd/227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf?index=true
Other scans of 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 17 Oct 2026 - malicious
- 17 Oct 2026 - malicious
- 16 Oct 2026 - malicious
- 15 Oct 2026 - malicious
- 15 Oct 2026 - malicious
- 15 Oct 2026 - malicious
- 14 Oct 2026 - malicious
- 14 Oct 2026 - malicious
- 14 Oct 2026 - malicious
- 13 Oct 2026 - malicious
Questions about 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com
- Is 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com safe?
- No. MalwareAnalyzer scanned 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com on 16 Oct 2026 and returned a malicious verdict with a score of 100 out of 100. Treat it as hostile until it is re-checked.
- What malware is associated with 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com?
- 17 analysed samples communicate with this URL. At least one was served directly from this host.
- How was 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan