The scan of airbays.com on 22 Aug 2026 reached no verdict either way (score 10). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with airbays.com?

1 analysed samples communicate with this URL, including Phishing.

How was airbays.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

airbays.com - URL scan, 22 Aug 2026

MalwareAnalyzer by Cyble scanned airbays.com and returned a unknown verdict (score 10), categorised as credential-harvest. The page resolved to 77.72.1.50 on Krystal Hosting in GB. The domain was registered 6506 days ago through GoDaddy.com, LLC. 4 domains and 1 IP were contacted, over 38 HTTP requests. 1 malware sample communicates with this URL (Phishing). This is a point-in-time observation from 22 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 10) · Confidence 19%
Scanned URL: https://airbays.com/userfiles/file/74407258577.pdf
Domain: airbays.com · IP: 77.72.1.50 · AS12488 · GB
Server: LiteSpeed
Page title: Page not found – Airbays
HTTP status: 404 · text/html; charset=UTF-8
Registrar: GoDaddy.com, LLC · domain age 6506 days · created 2008-10-28
TLS issuer: C=US, O=Let's Encrypt, CN=YR1 · valid to Oct 10 14: · subject CN=airbays.com
HTTP requests captured: 38
Scan tier: standard · observed 2026-08-22 06:50:36 UTC

Malware communicating with this URL (1)

These samples were observed contacting or being served from airbays.com. Each links to its full analysis.

Phishing - referenced · 5da0cc4f93197d880211f692904bba1a · first seen 2026-08-15

Antivirus & YARA (1 of 48 engines)

YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)

These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.

Why this verdict

Valid TLS, no impersonation or off-origin credential post
A signature matched text in the page (DLV_HTML_Smuggling) — pages that discuss malware can match, so this alone is not a malicious verdict
Credential-harvesting form

Detected technologies

LiteSpeed
WordPress
React
jQuery

Contacted infrastructure

77.72.1.50 - AS12488 Krystal Hosting (United Kingdom)

Observed indicators

airbays.com
stats.wp.com
fonts.googleapis.com
www.theclassictemplates.com
77.72.1.50
https://airbays.com/userfiles/file/74407258577.pdf
https://stats.wp.com/
https://fonts.googleapis.com/
https://airbays.com/index.php/feed/
https://airbays.com/index.php/comments/feed/
https://airbays.com/wp-content/plugins/woocommerce/assets/css/woocommerce-layout.css?ver=10.3.7
https://airbays.com/wp-content/plugins/woocommerce/assets/css/woocommerce-smallscreen.css?ver=10.3.7
https://airbays.com/wp-content/plugins/woocommerce/assets/css/woocommerce.css?ver=10.3.7
https://airbays.com/wp-content/plugins/currency-switcher-woocommerce/includes/lib/wSelect/wSelect.css?ver=2.16.4
https://airbays.com/wp-content/plugins/woocommerce/assets/css/select2.css?ver=10.3.7
https://airbays.com/wp-content/plugins/yith-woocommerce-affiliates/assets/css/yith-wcaf.min.css?ver=3.22.0
https://airbays.com/wp-content/plugins/yith-woocommerce-wishlist/assets/css/jquery.selectBox.css?ver=1.2.0
https://airbays.com/wp-content/plugins/woocommerce/assets/css/prettyPhoto.css?ver=3.1.6
https://airbays.com/wp-content/plugins/yith-woocommerce-wishlist/assets/css/style.css?ver=4.10.0
https://airbays.com/wp-content/plugins/yith-woocommerce-wishlist/assets/css/frontend/add-to-wishlist.css?ver=4.10.0

Questions about airbays.com

Is airbays.com safe?: The scan of airbays.com on 22 Aug 2026 reached no verdict either way (score 10). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with airbays.com?: 1 analysed samples communicate with this URL, including Phishing.
How was airbays.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the standard tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of airbays.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan