autosofortkauf.ch - URL scan, 16 Aug 2026
MalwareAnalyzer by Cyble scanned autosofortkauf.ch and returned a unknown verdict (score 12). The page resolved to 95.217.35.196 on Hetzner Online GmbH in FI. 6 domains and 1 IP were contacted, over 21 HTTP requests. 11 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 16 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 12) · Confidence 15%
- Scanned URL:
https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/tb9i6p5mr9cl18g115r7b7q5at/70765204553.pdf - Domain: autosofortkauf.ch · IP: 95.217.35.196 · AS24940 · FI
- Server: LiteSpeed
- Page title: Page not found - Autosofortkauf
- HTTP status: 404 · text/html; charset=UTF-8
- HTTP requests captured: 21
- Scan tier: fast · observed 2026-08-16 14:54:08 UTC
Malware communicating with this URL (11)
These samples were observed contacting or being served from autosofortkauf.ch. Each links to its full analysis.
- Phishing - referenced ·
95d084930e5861c50d469d91acefcc08· first seen 2026-08-16 - Phishing - referenced ·
90ec2e2099d50c43b22e572db6329723· first seen 2026-08-16 - Phishing - referenced ·
2de45e53817b5a73915141191731df2c· first seen 2026-08-15 - Phishing - referenced ·
663c2d6257cd8cfece3307d78eadac6f· first seen 2026-08-15 - Phishing - referenced ·
e1c68909d44c81df4b5ea85620a9fc62· first seen 2026-08-15 - Phishing - referenced ·
a14d506088fd1a7b50ba6ff8a801ff88· first seen 2026-08-15 - Phishing - referenced ·
ff4dbd15438d600feca4e60d78dc299d· first seen 2026-08-14 - Phishing - referenced ·
4a53d34b471571812b1f861b9e747cc3· first seen 2026-08-13 - Phishing - referenced ·
81bce915065732b507f6d78d31e92031· first seen 2026-08-12 - Phishing - referenced ·
c1efe98eaf76206964f491c5c32e1b5f· first seen 2026-08-12 - Phishing - referenced ·
fe68195ab0b0f199ef9add9cb6cc35a0· first seen 2026-08-12
Antivirus & YARA (1 of 47 engines)
- YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Why this verdict
- A signature matched text in the page (DLV_HTML_Smuggling) — pages that discuss malware can match, so this alone is not a malicious verdict
Detected technologies
- LiteSpeed
- PHP
- WordPress
- jQuery
Contacted infrastructure
- 95.217.35.196 - AS24940 Hetzner Online GmbH (Finland)
Observed indicators
- autosofortkauf.ch
- fonts.gstatic.com
- gmpg.org
- fonts.googleapis.com
- 7.203.5.101
- www.google.com
- 95.217.35.196
- https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/tb9i6p5mr9cl18g115r7b7q5at/70765204553.pdf
- https://fonts.gstatic.com/
- http://gmpg.org/xfn/11
- https://autosofortkauf.ch/xmlrpc.php
- https://fonts.googleapis.com/
- https://autosofortkauf.ch/feed/
- https://autosofortkauf.ch/comments/feed/
- https://autosofortkauf.ch/wp-content/plugins/litespeed-cache/assets/js/webfontloader.min.js
- https://autosofortkauf.ch/wp-content/litespeed/css/96e2ea44b741bda8f17cd77e73463bb1.css?ver=bf9b9
- https://autosofortkauf.ch/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
- https://autosofortkauf.ch/wp-content/litespeed/js/de20cf15e33c0aea72d717ad4697c41f.js?ver=98502
- https://autosofortkauf.ch/wp-json/
- https://autosofortkauf.ch/xmlrpc.php?rsd
Other scans of autosofortkauf.ch (2)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 22 Aug 2026 - unknown ·
https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/m34u1aq1ul9ae5h5aska3dak7 - 21 Aug 2026 - unknown ·
https://autosofortkauf.ch/wp-content/plugins/super-forms/uploads/php/files/uiu2dtujkvsplrgqh5e73dkp7
Questions about autosofortkauf.ch
- Is autosofortkauf.ch safe?
- The scan of autosofortkauf.ch on 16 Aug 2026 reached no verdict either way (score 12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with autosofortkauf.ch?
- 11 analysed samples communicate with this URL, including Phishing.
- How was autosofortkauf.ch checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of autosofortkauf.ch
Scanned on MalwareAnalyzer by Cyble · Open interactive scan