The scan of amtusa.com on 23 Aug 2026 reached no verdict either way (score 6). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with amtusa.com?

18 analysed samples communicate with this URL, including Phishing.

How was amtusa.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

amtusa.com - URL scan, 23 Aug 2026

MalwareAnalyzer by Cyble scanned amtusa.com and returned a unknown verdict (score 6). The page resolved to 207.148.248.143 on Newfold Digital, Inc. in US. The domain was registered 10574 days ago through GoDaddy.com, LLC. 1 domain and 1 IP were contacted. 18 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 23 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 6) · Confidence 9%
Scanned URL: http://amtusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080130f39550---67490518012.pdf
Domain: amtusa.com · IP: 207.148.248.143 · AS29873 · US
Server: Apache/2.4.6 (CentOS) PHP/5.6.8
Page title: 404 Not Found
HTTP status: 404 · text/html; charset=iso-8859-1
Registrar: GoDaddy.com, LLC · domain age 10574 days · created 1997-09-10
Scan tier: fast · observed 2026-08-23 09:31:54 UTC

Malware communicating with this URL (18)

These samples were observed contacting or being served from amtusa.com. Each links to its full analysis.

Phishing - referenced · 26bc4e1e38619cdeb55fd9f34e1e7a91 · first seen 2026-08-23
Phishing - referenced · 7c410cca596efcd54cc0a2af72155a68 · first seen 2026-08-23
Phishing - referenced · 34d7bf79d2557e3ff5c98994b2016230 · first seen 2026-08-23
Phishing - referenced · 88e758b844d9a49ea6a3dd62737ca060 · first seen 2026-08-20
Phishing - referenced · dc6e12d4754657f8a334d785de185c3e · first seen 2026-08-20
Phishing - referenced · 294950b75730f6a0fa49149a3c26f9ad · first seen 2026-08-19
Phishing - referenced · 3e992576e199824641d827ebe31493f4 · first seen 2026-08-19
Phishing - referenced · 0ff607c633d71c83c1412de7df83ed97 · first seen 2026-08-16
Phishing - referenced · d6c6c6db8f7cf4a0783af2e602a79d09 · first seen 2026-08-15
Phishing - referenced · f7eaa43d607f36cb4d30c3e6ebb36ca8 · first seen 2026-08-15
Phishing - referenced · 63eb50c869c6d4ec8cfbcd9d20d6a3f7 · first seen 2026-08-15
Phishing - referenced · 6bbcb828d31ed590232fe4941d27efbd · first seen 2026-08-14
Phishing - referenced · d8e4bf912b6d3c52eabc58a29b375ee1 · first seen 2026-08-13
Phishing - referenced · a632f9b0f6eb852a6f62197e02443abe · first seen 2026-08-13
Phishing - referenced · 7624c4feed58a7522d66f13ba5db36dc · first seen 2026-08-13

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Why this verdict

Served over plaintext HTTP

Detected technologies

Apache
WordPress

Contacted infrastructure

207.148.248.143 - AS29873 Newfold Digital, Inc. (United States)

Observed indicators

amtusa.com
207.148.248.143
http://amtusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080130f39550---67490518012.pdf

Other scans of amtusa.com (3)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

20 Aug 2026 - unknown · http://amtusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612f02b695c8d---215
15 Aug 2026 - unknown · http://amtusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/160db8bd528d4c---rig
13 Aug 2026 - unknown · http://amtusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c4a55d35c4---994

Questions about amtusa.com

Is amtusa.com safe?: The scan of amtusa.com on 23 Aug 2026 reached no verdict either way (score 6). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with amtusa.com?: 18 analysed samples communicate with this URL, including Phishing.
How was amtusa.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of amtusa.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan