Is booking.builtwithfrappe.com safe?

No. MalwareAnalyzer scanned booking.builtwithfrappe.com on 23 Aug 2026 and returned a malicious verdict with a score of 66 out of 100. Treat it as hostile until it is re-checked.

How was booking.builtwithfrappe.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

booking.builtwithfrappe.com - malicious URL scan, 23 Aug 2026

MalwareAnalyzer by Cyble scanned booking.builtwithfrappe.com and returned a malicious verdict (score 66). The page resolved to 63.142.251.181 on Nodisto IT, LLC in US. The domain was registered 304 days ago through NameCheap, Inc.. 2 domains and 1 IP were contacted, over 8 HTTP requests. This is a point-in-time observation from 23 Aug 2026; the page may have changed since.

Scan result

Verdict: malicious (score 66) · Confidence 75%
Scanned URL: https://booking.builtwithfrappe.com/
Domain: booking.builtwithfrappe.com · IP: 63.142.251.181 · AS394727 · US
Server: nginx/1.24.0 (Ubuntu)
Page title: Updating
HTTP status: 503 · text/html; charset=utf-8
Registrar: NameCheap, Inc. · domain age 304 days · created 2025-10-23
TLS issuer: C=US, O=Let's Encrypt, CN=YE1 · valid to Nov 21 02: · subject CN=booking.builtwithfrappe.com
HTTP requests captured: 8 · outgoing links: 3
Scan tier: standard · observed 2026-08-23 19:09:21 UTC

Antivirus & YARA (3 of 48 engines)

YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
YARA: SophosLabs IoCs (public) [yara]: SOPHOS_Gootloader_JS (page content)
YARA: Stratosphere IPS [yara]: STRATO_Tor_Onion_C2 (page content)

Why this verdict

3 antivirus/YARA engines flagged the page content: DLV_HTML_Smuggling, SOPHOS_Gootloader_JS, STRATO_Tor_Onion_C2
Valid TLS, no impersonation or off-origin credential post
Certificate issued < 48h ago

Detected technologies

Nginx

Contacted infrastructure

63.142.251.181 - AS394727 Nodisto IT, LLC (United States)

Observed indicators

booking.builtwithfrappe.com
frappeframework.com
63.142.251.181
https://booking.builtwithfrappe.com/
https://booking.builtwithfrappe.com/assets/frappe/images/frappe-favicon.svg
https://booking.builtwithfrappe.com/assets/frappe/dist/css/website.bundle.DM3UZLW7.css
https://booking.builtwithfrappe.com/login
https://frappeframework.com/?source=website_footer
https://booking.builtwithfrappe.com/assets/frappe/dist/js/frappe-web.bundle.HYMHVLR3.js
https://booking.builtwithfrappe.com/website_script.js

Questions about booking.builtwithfrappe.com

Is booking.builtwithfrappe.com safe?: No. MalwareAnalyzer scanned booking.builtwithfrappe.com on 23 Aug 2026 and returned a malicious verdict with a score of 66 out of 100. Treat it as hostile until it is re-checked.
How was booking.builtwithfrappe.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the standard tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of booking.builtwithfrappe.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan