Is clairerolo.com safe?

No. MalwareAnalyzer scanned clairerolo.com on 19 Aug 2026 and returned a suspicious verdict with a score of 36 out of 100, categorised as credential-harvest. Treat it as hostile until it is re-checked.

What malware is associated with clairerolo.com?

5 analysed samples communicate with this URL, including Phishing.

How was clairerolo.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

clairerolo.com - suspicious URL scan, 19 Aug 2026

MalwareAnalyzer by Cyble scanned clairerolo.com and returned a suspicious verdict (score 36), categorised as credential-harvest. The page resolved to 66.102.133.116 on HostPapa in CA. The domain was registered 6138 days ago through GoDaddy.com, LLC. 3 domains and 1 IP were contacted, over 33 HTTP requests. 5 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 19 Aug 2026; the page may have changed since.

Scan result

Verdict: suspicious (score 36) · Confidence 45%
Scanned URL: http://clairerolo.com/userfiles/file/mopuxasuzudilumoxefejo.pdf
Domain: clairerolo.com · IP: 66.102.133.116 · AS40092 · CA
Server: nginx
Page title: Page not found – Claire Rolo
HTTP status: 404 · text/html; charset=UTF-8
Registrar: GoDaddy.com, LLC · domain age 6138 days · created 2009-10-29
HTTP requests captured: 33
Scan tier: fast · observed 2026-08-19 19:25:10 UTC

Malware communicating with this URL (5)

These samples were observed contacting or being served from clairerolo.com. Each links to its full analysis.

Phishing - referenced · c729942deeacad4e28211f0709c1032d · first seen 2026-08-19
55230356782.pdf - referenced · 138e472d28e67119f2c0450bfe1c1b73 · first seen 2026-08-19
Phishing - referenced · 86d11ab04ea75369f6020c85154cc238 · first seen 2026-08-16
Phishing - referenced · e5d30ddd993629d89c489748a449e193 · first seen 2026-08-14
Phishing - referenced · b49098c67cc68c13c012bfaaaf639c11 · first seen 2026-08-11

Antivirus & YARA (1 of 47 engines)

YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)

These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.

Why this verdict

Credential-harvesting form
A signature matched text in the page (DLV_HTML_Smuggling) — pages that discuss malware can match, so this alone is not a malicious verdict
Served over plaintext HTTP

Detected technologies

Nginx
PHP
WordPress
jQuery
Bootstrap

Contacted infrastructure

66.102.133.116 - AS40092 HostPapa (Canada)

Observed indicators

clairerolo.com
fonts.googleapis.com
luxus.wplistingthemes.com
66.102.133.116
http://clairerolo.com/userfiles/file/mopuxasuzudilumoxefejo.pdf
http://fonts.googleapis.com/
https://clairerolo.com/feed/
https://clairerolo.com/comments/feed/
http://clairerolo.com/wp-content/plugins/luxus-core/public/css/leaflet.min.css?ver=1.0
http://clairerolo.com/wp-content/plugins/luxus-core/public/css/MarkerCluster.css?ver=1.0
http://clairerolo.com/wp-content/plugins/luxus-core/public/css/MarkerClusterDefault.css?ver=1.0
http://clairerolo.com/wp-content/themes/luxus/assets/css/magnific-popup.min.css?ver=all
http://clairerolo.com/wp-includes/css/dist/block-library/style.min.css?ver=7.0.4
http://clairerolo.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.7
http://clairerolo.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=4.2.2
http://clairerolo.com/wp-content/uploads/elementor/css/post-15676.css?ver=1787127953
http://clairerolo.com/wp-content/uploads/elementor/css/post-15729.css?ver=1787127953
http://clairerolo.com/wp-includes/css/dashicons.min.css?ver=7.0.4
http://clairerolo.com/wp-content/plugins/luxus-core/public/css/fontawesome.all.min.css?ver=5.14.0
http://clairerolo.com/wp-content/plugins/luxus-core/public/css/toastr.min.css?ver=all

Other scans of clairerolo.com (3)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

14 Aug 2026 - suspicious · http://clairerolo.com/userfiles/file/95554858988.pdf
14 Aug 2026 - suspicious · http://clairerolo.com/userfiles/file/95554858988.pdf
14 Aug 2026 - suspicious · http://clairerolo.com/userfiles/file/95554858988.pdf

Questions about clairerolo.com

Is clairerolo.com safe?: No. MalwareAnalyzer scanned clairerolo.com on 19 Aug 2026 and returned a suspicious verdict with a score of 36 out of 100, categorised as credential-harvest. Treat it as hostile until it is re-checked.
What malware is associated with clairerolo.com?: 5 analysed samples communicate with this URL, including Phishing.
How was clairerolo.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of clairerolo.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan