6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com - malicious URL scan, 15 Oct 2026
MalwareAnalyzer by Cyble scanned 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com and returned a malicious verdict (score 100). The page resolved to 18.67.93.118 on Amazon.com, Inc. in US. The domain was registered 3334 days ago through GoDaddy.com, LLC. 1 domain and 1 IP were contacted. 14 malware samples communicate with this URL. This is a point-in-time observation from 15 Oct 2026; the page may have changed since.
Scan result
- Verdict: malicious (score 100) · Confidence 80%
- Scanned URL:
https://6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com/ugd/35c6e2_2059b52814764830a4fa6d03ab5a600d.pdf?index=true - Domain: 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com · IP: 18.67.93.118 · AS16509 · US
- Server: openresty/1.31.1.1
- HTTP status: 200 · application/pdf
- Registrar: GoDaddy.com, LLC · domain age 3334 days · created 2017-08-28
- Scan tier: fast · observed 2026-10-15 00:34:34 UTC
Malware communicating with this URL (14)
These samples were observed contacting or being served from 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com, and at least one was hosted here. Each links to its full analysis.
- bcd086_dd9ea856f9f34c3dab4fabcd69c32a70.pdf - referenced (hosted here) ·
a32f3f4b89ce4b0dcd0aae886a8f6362· first seen 2026-08-27 - d1c05f_baa6e0c3380149d7acc4cc73c92eb874.pdf - referenced (hosted here) ·
943bedd46664b718723c8521b3aec7ac· first seen 2026-08-29 - f99735_2bea662f78274190869e2e64f945ec1e.pdf - referenced (hosted here) ·
4678c5d037ed7a4aaa3f294bec48893e· first seen 2026-09-01 - 35c6e2_3790b3ad52ff4f62874d5a7485d70db3.pdf - referenced (hosted here) ·
229465f32820046b7c42f501d6c6107d· first seen 2026-08-26 - 565485_d06b4c7b971f4f418c6d7ab0ba430279.pdf - referenced (hosted here) ·
80cadf915beaf3bc6e0ea002e5028ee5· first seen 2026-08-27 - 26481d_9eb592fb8e0049e28d633eda97bc06c6.pdf - referenced (hosted here) ·
cc5bae1fe92993772fe4bd27e8effcd3· first seen 2026-08-27 - f99735_3606171bbdd64b1090c7780f050b839d.pdf - referenced (hosted here) ·
d4b4feb9af3576b1481b46ddcc4879ad· first seen 2026-08-28 - 9cfd0a_40b54cf3482047cc97e8bfcca805dc67.pdf - referenced (hosted here) ·
dd556993c562e901902003671cf62f5f· first seen 2026-09-07 - e49726_c39691efbea047ceb6310e9493503d59.pdf - referenced (hosted here) ·
57f791db5abe5d7f791f009d53de02f4· first seen 2026-09-05 - 1e52da_36b2ebb9a55c4536a045c10470c79cc1.pdf - referenced (hosted here) ·
c6a4c1b63bab9a16b964155fb79584db· first seen 2026-09-10 - d93890_ed7560aec57e4950a4e5ac7da5395200.pdf - referenced (hosted here) ·
8bdf3b7b53c8f856982ebba126435beb· first seen 2026-09-18 - 5af86b_c0981fb55f224a4babded96bba44a3bd.pdf - referenced (hosted here) ·
91c06120705608761d2a85e7fb510344· first seen 2026-09-06 - fb83f1_be0688c250cc423b840edd15db267ec4.pdf - referenced (hosted here) ·
d16b653a43e0926b7282568214336ec4· first seen 2026-08-29 - 384ea4_9682d6fc3f6647809f65b0c2323ebdfd.pdf - referenced (hosted here) ·
2ef2cab7c1f8e7493500f5d4821001bc· first seen 2026-08-28
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Hosts payload/config for 14 malware samples
- Grabbed file (35c6e2_2059b52814764830a4fa6d03ab5a600d.pdf) is known malicious in the corpus
- File download routed to the malware sandbox (35c6e2_2059b52814764830a4fa6d03ab5a600d.pdf)
Detected technologies
- Amazon CloudFront
Contacted infrastructure
- 18.67.93.118 - AS16509 Amazon.com, Inc. (US)
Files served by this page
- 35c6e2_2059b52814764830a4fa6d03ab5a600d.pdf ·
731d00f52a9d18d800abbe3f15b5a23c
Observed indicators
- 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com
- 18.67.93.118
- https://6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com/ugd/35c6e2_2059b52814764830a4fa6d03ab5a600d.pdf?index=true
Other scans of 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 17 Oct 2026 - malicious
- 16 Oct 2026 - malicious
- 16 Oct 2026 - malicious
- 15 Oct 2026 - malicious
- 14 Oct 2026 - malicious
- 14 Oct 2026 - malicious
- 13 Oct 2026 - malicious
- 13 Oct 2026 - malicious
- 12 Oct 2026 - malicious
- 12 Oct 2026 - malicious
Questions about 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com
- Is 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com safe?
- No. MalwareAnalyzer scanned 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com on 15 Oct 2026 and returned a malicious verdict with a score of 100 out of 100. Treat it as hostile until it is re-checked.
- What malware is associated with 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com?
- 14 analysed samples communicate with this URL. At least one was served directly from this host.
- How was 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of 6f2a3e62-8287-42b6-809b-c84334d9dc61.filesusr.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan