autosofortkauf.ch - URL scan, 21 Aug 2026
MalwareAnalyzer by Cyble scanned autosofortkauf.ch and returned a unknown verdict (score 12). The page resolved to 95.217.35.196 on Hetzner Online GmbH in FI. 6 domains and 1 IP were contacted, over 21 HTTP requests. 18 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 21 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 12) · Confidence 15%
- Scanned URL:
https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/uiu2dtujkvsplrgqh5e73dkp7d/89210322413.pdf - Domain: autosofortkauf.ch · IP: 95.217.35.196 · AS24940 · FI
- Server: LiteSpeed
- Page title: Page not found - Autosofortkauf
- HTTP status: 404 · text/html; charset=UTF-8
- HTTP requests captured: 21
- Scan tier: fast · observed 2026-08-21 23:17:04 UTC
Malware communicating with this URL (18)
These samples were observed contacting or being served from autosofortkauf.ch. Each links to its full analysis.
- Phishing - referenced ·
6f5466d8aa0856e09066a7feeb56b1f0· first seen 2026-08-21 - Phishing - referenced ·
a390e998dde8c9282bef571641c4e5b4· first seen 2026-08-21 - Phishing - referenced ·
b52c1318688f9833d161ca4baf43bb8b· first seen 2026-08-21 - Phishing - referenced ·
e38bf393d0a49757513194aa97f4ad68· first seen 2026-08-19 - Phishing - referenced ·
12c57499385babfbf8fa252912dd7281· first seen 2026-08-17 - Phishing - referenced ·
85d967ca7a8bc41e236e0506f1c928e6· first seen 2026-08-17 - Phishing - referenced ·
a0af575d82c3ecee588f42caee266a07· first seen 2026-08-16 - Phishing - referenced ·
95d084930e5861c50d469d91acefcc08· first seen 2026-08-16 - Phishing - referenced ·
90ec2e2099d50c43b22e572db6329723· first seen 2026-08-16 - Phishing - referenced ·
2de45e53817b5a73915141191731df2c· first seen 2026-08-15 - Phishing - referenced ·
663c2d6257cd8cfece3307d78eadac6f· first seen 2026-08-15 - Phishing - referenced ·
e1c68909d44c81df4b5ea85620a9fc62· first seen 2026-08-15 - Phishing - referenced ·
a14d506088fd1a7b50ba6ff8a801ff88· first seen 2026-08-15 - Phishing - referenced ·
ff4dbd15438d600feca4e60d78dc299d· first seen 2026-08-14 - Phishing - referenced ·
4a53d34b471571812b1f861b9e747cc3· first seen 2026-08-13
Antivirus & YARA (1 of 48 engines)
- YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Why this verdict
- A signature matched text in the page (DLV_HTML_Smuggling) — pages that discuss malware can match, so this alone is not a malicious verdict
Detected technologies
- LiteSpeed
- PHP
- WordPress
- jQuery
Contacted infrastructure
- 95.217.35.196 - AS24940 Hetzner Online GmbH (Finland)
Observed indicators
- autosofortkauf.ch
- fonts.gstatic.com
- gmpg.org
- fonts.googleapis.com
- 7.203.5.101
- www.google.com
- 95.217.35.196
- https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/uiu2dtujkvsplrgqh5e73dkp7d/89210322413.pdf
- https://fonts.gstatic.com/
- http://gmpg.org/xfn/11
- https://autosofortkauf.ch/xmlrpc.php
- https://fonts.googleapis.com/
- https://autosofortkauf.ch/feed/
- https://autosofortkauf.ch/comments/feed/
- https://autosofortkauf.ch/wp-content/plugins/litespeed-cache/assets/js/webfontloader.min.js
- https://autosofortkauf.ch/wp-content/litespeed/css/24caaffd58eb347c9d11d2a9b6665651.css?ver=bf9b9
- https://autosofortkauf.ch/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
- https://autosofortkauf.ch/wp-content/litespeed/js/de20cf15e33c0aea72d717ad4697c41f.js?ver=98502
- https://autosofortkauf.ch/wp-json/
- https://autosofortkauf.ch/xmlrpc.php?rsd
Other scans of autosofortkauf.ch (2)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 22 Aug 2026 - unknown ·
https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/m34u1aq1ul9ae5h5aska3dak7 - 16 Aug 2026 - unknown ·
https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/tb9i6p5mr9cl18g115r7b7q5a
Questions about autosofortkauf.ch
- Is autosofortkauf.ch safe?
- The scan of autosofortkauf.ch on 21 Aug 2026 reached no verdict either way (score 12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with autosofortkauf.ch?
- 18 analysed samples communicate with this URL, including Phishing.
- How was autosofortkauf.ch checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of autosofortkauf.ch
Scanned on MalwareAnalyzer by Cyble · Open interactive scan