54www.whm.36ap-northeast-1.vpce.amazonmap.medellin.onl - suspicious URL scan, 23 Aug 2026

MalwareAnalyzer by Cyble scanned 54www.whm.36ap-northeast-1.vpce.amazonmap.medellin.onl and returned a suspicious verdict (score 40). The domain was registered 176 days ago through NameCheap, Inc.. 1 domain and 0 IPs were contacted. This is a point-in-time observation from 23 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 40) · Confidence 46%
• Scanned URL: https://54www.whm.36ap-northeast-1.vpce.amazonmap.medellin.onl/
• Domain: 54www.whm.36ap-northeast-1.vpce.amazonmap.medellin.onl · AS26832 · CA
• Registrar: NameCheap, Inc. · domain age 176 days · created 2026-02-28
• Scan tier: standard · observed 2026-08-23 19:10:21 UTC

Antivirus & YARA (1 of 48 engines)

• YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)

These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.

Why this verdict

• Antivirus/YARA detection in page content: DLV_HTML_Smuggling
• Target did not respond (DNS/connection failure or timeout); verdict from URL structure only

Contacted infrastructure

• 38.102.126.242 - AS26832 Rica Web Services (Canada)

Observed indicators

• 54www.whm.36ap-northeast-1.vpce.amazonmap.medellin.onl
• https://54www.whm.36ap-northeast-1.vpce.amazonmap.medellin.onl/

Questions about 54www.whm.36ap-northeast-1.vpce.amazonmap.medellin.onl

Is 54www.whm.36ap-northeast-1.vpce.amazonmap.medellin.onl safe?

No. MalwareAnalyzer scanned 54www.whm.36ap-northeast-1.vpce.amazonmap.medellin.onl on 23 Aug 2026 and returned a suspicious verdict with a score of 40 out of 100. Treat it as hostile until it is re-checked.

How was 54www.whm.36ap-northeast-1.vpce.amazonmap.medellin.onl checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the standard tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of 54www.whm.36ap-northeast-1.vpce.amazonmap.medellin.onl

Scanned on MalwareAnalyzer by Cyble · Open interactive scan