506hlapeta.com - URL scan, 19 Aug 2026
MalwareAnalyzer by Cyble scanned 506hlapeta.com and returned a unknown verdict (score -12). The page resolved to 3.125.172.46 on A100 ROW GmbH in DE. The domain was registered 6837 days ago through PDR Ltd. d/b/a PublicDomainRegistry.com. 6 domains and 1 IP were contacted, over 3 HTTP requests. 1 malware sample communicates with this URL (Phishing). This is a point-in-time observation from 19 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://506hlapeta.com/files/file/21884807603.pdf - Domain: 506hlapeta.com · IP: 3.125.172.46 · AS16509 · DE
- Server: webnode
- Page title: 404 - Страницата не е намерена :: 506 хлапета
- HTTP status: 404 · text/html; charset=UTF-8
- Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com · domain age 6837 days · created 2007-11-30
- TLS issuer: C=US, O=Let's Encrypt, CN=YR2 · valid to Sep 23 16: · subject CN=506hlapeta.com
- HTTP requests captured: 3
- Scan tier: fast · observed 2026-08-19 22:11:38 UTC
Malware communicating with this URL (1)
These samples were observed contacting or being served from 506hlapeta.com. Each links to its full analysis.
- Phishing - referenced ·
dadf4ba43c19e5e2f87f29d6162e7e36· first seen 2026-08-15
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Google Analytics
Contacted infrastructure
- 3.125.172.46 - AS16509 A100 ROW GmbH (Germany)
Observed indicators
- 506hlapeta.com
- duyn491kcolsw.cloudfront.net
- fonts.gstatic.com
- b2a1dba9cf.clvaw-cdnwnd.com
- www.506hlapeta.com
- www.googletagmanager.com
- 3.125.172.46
- https://506hlapeta.com/files/file/21884807603.pdf
- https://duyn491kcolsw.cloudfront.net/
- https://fonts.gstatic.com/
- https://b2a1dba9cf.clvaw-cdnwnd.com/e39241bf30336993f0913e4cfa393ea0/200000943-706fe70700/506%20%D0%BB%D0%BE%D0%B3%D0%BE%20final%20-%20%D0%B1%D0%B0%D0%B7%D0%B0%201%20%281%29.png?ph=b2a1dba9cf
- https://duyn491kcolsw.cloudfront.net/files/0r/0rk/0rklmm.css?ph=b2a1dba9cf
- https://duyn491kcolsw.cloudfront.net/files/3n/3ny/3ny4od.css?ph=b2a1dba9cf
- https://duyn491kcolsw.cloudfront.net/files/1i/1ik/1ikvgu.css?ph=b2a1dba9cf
- https://duyn491kcolsw.cloudfront.net/files/0k/0k1/0k1ucs.css?ph=b2a1dba9cf
- https://duyn491kcolsw.cloudfront.net/files/3i/3it/3ito8n.css?ph=b2a1dba9cf
- https://duyn491kcolsw.cloudfront.net/files/2m/2m8/2m8lqh.css?ph=b2a1dba9cf
- https://duyn491kcolsw.cloudfront.net/files/1w/1wx/1wxsob.css?ph=b2a1dba9cf
- https://duyn491kcolsw.cloudfront.net/files/28/28l/28lqry.css?ph=b2a1dba9cf
- https://duyn491kcolsw.cloudfront.net/files/1u/1uz/1uzze2.css?ph=b2a1dba9cf
Other scans of 506hlapeta.com (1)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 19 Aug 2026 - unknown
Questions about 506hlapeta.com
- Is 506hlapeta.com safe?
- The scan of 506hlapeta.com on 19 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with 506hlapeta.com?
- 1 analysed samples communicate with this URL, including Phishing.
- How was 506hlapeta.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of 506hlapeta.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan