cdn.jsdelivr.cc - suspicious URL scan, 21 Aug 2026
MalwareAnalyzer by Cyble scanned cdn.jsdelivr.cc and returned a suspicious verdict (score 27). The page resolved to 104.21.34.87 on Cloudflare, Inc. in US. The domain was registered 1959 days ago through NameCheap, Inc.. 1 domain and 1 IP were contacted. 24 malware samples communicate with this URL. This is a point-in-time observation from 21 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 27) · Confidence 36%
- Scanned URL:
https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js - Domain: cdn.jsdelivr.cc · IP: 104.21.34.87 · AS13335 · US
- Server: cloudflare
- HTTP status: 200 · text/javascript
- Registrar: NameCheap, Inc. · domain age 1959 days · created 2021-04-10
- TLS issuer: C=US, O=Google Trust Services, CN=WE1 · valid to Sep 29 05: · subject CN=jsdelivr.cc
- Scan tier: fast · observed 2026-08-21 20:42:19 UTC
Malware communicating with this URL (24)
These samples were observed contacting or being served from cdn.jsdelivr.cc. Each links to its full analysis.
- f83ada020399dddcfc3f0716b83c3397f03c8836b6cddf631b03f6e69988968b - referenced ·
f83ada020399dddcfc3f0716b83c3397· first seen 2026-08-21 - 45dd7edf04577179e87f47377b659cc405d6880c126ee772a110dc97249daa42 - referenced ·
45dd7edf04577179e87f47377b659cc4· first seen 2026-08-21 - af308ff0e19f7abf4e36bb50b87c7b52af5662012b673e706a05ae2803b9fe7f - referenced ·
af308ff0e19f7abf4e36bb50b87c7b52· first seen 2026-08-21 - f6e57148739ef2abece2a8f1af6b494a92d69fa4091aeea9c1b965c2accfed73 - referenced ·
f6e57148739ef2abece2a8f1af6b494a· first seen 2026-08-21 - 15ea3e15f10facea0c990d2fafff6c4f2a191060e80572d236f4eb95a0918c40 - referenced ·
15ea3e15f10facea0c990d2fafff6c4f· first seen 2026-08-21 - 6373287286d936149e5ad101bc2791025a83302e029d4c0aa0a01c18855f9c65 - referenced ·
6373287286d936149e5ad101bc279102· first seen 2026-08-21 - 2fead45b16e04d8b1a6aa780aa3934320f77e08777c66e7acacfb46710b853d1 - referenced ·
2fead45b16e04d8b1a6aa780aa393432· first seen 2026-08-21 - 54b42d5c52e78ee91dfc574d2893c0137f40a9d30bcd45c9bc48bd578729d337 - referenced ·
54b42d5c52e78ee91dfc574d2893c013· first seen 2026-08-20 - 73d8de459d4cb33e21e4a2a19a48aa88bbe70c30adc734c618376073b5fdeeb1 - referenced ·
73d8de459d4cb33e21e4a2a19a48aa88· first seen 2026-08-16 - 3cac416bd50b979aab6217f6f4706db990d2f144aabd57dd04897daa1d069842 - referenced ·
3cac416bd50b979aab6217f6f4706db9· first seen 2026-08-15 - 739b868893617e4dd7933b5c675e639d8bee7b831eb809a08bda12066e7f0a70 - referenced ·
739b868893617e4dd7933b5c675e639d· first seen 2026-08-15 - a0bc56af8068c80d9d2e6a49406306dce372a7bb7f36681dffa7daaa3c049aad - referenced ·
a0bc56af8068c80d9d2e6a49406306dc· first seen 2026-08-15 - e91f5086b4e979eb2118f62c0c3a31b9f9d7536c8f1c9833d099e114e57188af - referenced ·
e91f5086b4e979eb2118f62c0c3a31b9· first seen 2026-08-14 - e8b3ef2acec859e800be975218771e597e53e7faaed56a0a28c681db7f19a823 - referenced ·
e8b3ef2acec859e800be975218771e59· first seen 2026-08-14 - 0e937ba616f17e62e22905205b60448d9409f05bb9f285a524568ac1f9477fbd - referenced ·
0e937ba616f17e62e22905205b60448d· first seen 2026-08-14
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Grabbed file (jquery.min.js) is known suspicious in the corpus
- File download routed to the malware sandbox (jquery.min.js)
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Cloudflare
Contacted infrastructure
- 104.21.34.87 - AS13335 Cloudflare, Inc. (United States)
Files served by this page
- jquery.min.js ·
ee11e902416a1d896f538103110337b3
Observed indicators
- cdn.jsdelivr.cc
- 104.21.34.87
- https://cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
Other scans of cdn.jsdelivr.cc (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - suspicious ·
https://cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js - 23 Aug 2026 - suspicious ·
https://cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js - 23 Aug 2026 - suspicious ·
https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js - 23 Aug 2026 - suspicious
- 23 Aug 2026 - suspicious ·
https://cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js - 23 Aug 2026 - suspicious ·
https://cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js - 23 Aug 2026 - suspicious ·
https://cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js - 23 Aug 2026 - suspicious ·
https://cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js - 23 Aug 2026 - suspicious
- 23 Aug 2026 - suspicious ·
https://cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
Questions about cdn.jsdelivr.cc
- Is cdn.jsdelivr.cc safe?
- No. MalwareAnalyzer scanned cdn.jsdelivr.cc on 21 Aug 2026 and returned a suspicious verdict with a score of 27 out of 100. Treat it as hostile until it is re-checked.
- What malware is associated with cdn.jsdelivr.cc?
- 24 analysed samples communicate with this URL.
- How was cdn.jsdelivr.cc checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of cdn.jsdelivr.cc
Scanned on MalwareAnalyzer by Cyble · Open interactive scan