9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com - malicious URL scan, 16 Oct 2026
MalwareAnalyzer by Cyble scanned 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com and returned a malicious verdict (score 100). The page resolved to 18.67.93.118 on Amazon.com, Inc. in US. The domain was registered 3336 days ago through GoDaddy.com, LLC. 1 domain and 1 IP were contacted. 29 malware samples communicate with this URL. This is a point-in-time observation from 16 Oct 2026; the page may have changed since.
Scan result
- Verdict: malicious (score 100) · Confidence 80%
- Scanned URL:
https://9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com/ugd/3ed902_b9fcd049bd5e4a4fa6a1357f49380d31.pdf?index=true - Domain: 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com · IP: 18.67.93.118 · AS16509 · US
- Server: openresty/1.31.1.1
- HTTP status: 200 · application/pdf
- Registrar: GoDaddy.com, LLC · domain age 3336 days · created 2017-08-28
- Scan tier: fast · observed 2026-10-16 16:57:57 UTC
Malware communicating with this URL (29)
These samples were observed contacting or being served from 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com, and at least one was hosted here. Each links to its full analysis.
- 18f527_3d02f6ef78ae46ad9000f6d857408126.pdf - referenced (hosted here) ·
d1f3f49d4b73e4b79850f9fb5efafeda· first seen 2026-08-27 - 974a4e_93282fd6a596434cba2f4cd3c81569ae.pdf - referenced (hosted here) ·
748b2274f3cedd035a616ab330042046· first seen 2026-08-27 - 110ef3_b8612b58bf6b4742b1ec3c017f8f5669.pdf - referenced (hosted here) ·
424bf546eb8e60492dd78d14329dd89c· first seen 2026-08-27 - 33ab24_46db40b81b0e426690cae40ecd3c3878.pdf - referenced (hosted here) ·
8d1d4b63a5e6f7dc5319a098d2609acf· first seen 2026-08-28 - 4329d7_c67d8ccbfa9246ffbc237411fb4db236.pdf - referenced (hosted here) ·
2dffefd1b50a839b1cd418f8aaf1c276· first seen 2026-08-26 - dcf9ad_ddc1e8121f364633afff8f76663f6910.pdf - referenced (hosted here) ·
7690e9d35973f8fdac229df8f8fee7de· first seen 2026-08-27 - f1780b_6fdeed7b85a149749cb18f9e1e52f613.pdf - referenced (hosted here) ·
24c5e3afa50b9444f5c37399efd68b5f· first seen 2026-08-27 - d6af85_2f58677fe14f4d74a7bc66aec2d9058c.pdf - referenced (hosted here) ·
96b9b43b29e8561553af87e7fa444aa1· first seen 2026-08-27 - 4b874d_5c9816ea9a51406a9c5372efc6b804fd.pdf - referenced (hosted here) ·
a1837345ec5e540b0b2e55ced94a6dbd· first seen 2026-08-27 - 50988c_f1b44672a52f4935851d4315700228d9.pdf - referenced (hosted here) ·
5d318e99d0ceb345dc5c8b7412968439· first seen 2026-08-30 - 682d1c_c0eb4190d7814093b444c277ec12abe5.pdf - referenced (hosted here) ·
c96137198636bada5e6092f596105c92· first seen 2026-08-27 - 89064d_00c568b66dd34adb94a6d30d27c3578f.pdf - referenced (hosted here) ·
900b3139cb029d3b4659439fbf8c78f3· first seen 2026-08-26 - 33ab24_924de9c6e5e446808e0a859bb0e8d2b7.pdf - referenced (hosted here) ·
bf36abd1f6f9d4a4de36d16ace7b55cd· first seen 2026-08-27 - 0af078_0088396957534b62beaaaf4f415ae176.pdf - referenced (hosted here) ·
806058b90e7cfbeb32239d89a4b269be· first seen 2026-08-28 - 7be1cd_5d4839e076084ee5a53a4207c5e3708f.pdf - referenced (hosted here) ·
f94f912655e64bc88e878dd5376430d8· first seen 2026-08-27
Antivirus & YARA
The engine tier did not run for this scan, so its content is unjudged rather than clean.
Why this verdict
- Hosts payload/config for 29 malware samples
- Grabbed file (3ed902_b9fcd049bd5e4a4fa6a1357f49380d31.pdf) is known malicious in the corpus
- File download routed to the malware sandbox (3ed902_b9fcd049bd5e4a4fa6a1357f49380d31.pdf)
Detected technologies
- Amazon CloudFront
Contacted infrastructure
- 18.67.93.118 - AS16509 Amazon.com, Inc. (US)
Files served by this page
- 3ed902_b9fcd049bd5e4a4fa6a1357f49380d31.pdf ·
ab58e3d234cca0eafd0337035f954808
Observed indicators
- 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com
- 18.67.93.118
- https://9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com/ugd/3ed902_b9fcd049bd5e4a4fa6a1357f49380d31.pdf?index=true
Other scans of 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 17 Oct 2026 - malicious
- 17 Oct 2026 - malicious
- 17 Oct 2026 - malicious
- 16 Oct 2026 - malicious
- 16 Oct 2026 - malicious
- 16 Oct 2026 - malicious
- 15 Oct 2026 - malicious
- 15 Oct 2026 - malicious
- 15 Oct 2026 - malicious
- 15 Oct 2026 - malicious
Questions about 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com
- Is 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com safe?
- No. MalwareAnalyzer scanned 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com on 16 Oct 2026 and returned a malicious verdict with a score of 100 out of 100. Treat it as hostile until it is re-checked.
- What malware is associated with 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com?
- 29 analysed samples communicate with this URL. At least one was served directly from this host.
- How was 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of 9905952b-a71d-4b86-ad50-22ba09231c6d.filesusr.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan