creativecommons.org - URL scan, 24 Aug 2026
MalwareAnalyzer by Cyble scanned creativecommons.org and returned a unknown verdict (score -12). The page resolved to 104.20.6.134 on Cloudflare, Inc. in US. The domain was registered 9351 days ago through Gandi SAS. 12 domains and 2 IPs were contacted, over 4 HTTP requests. 450 malware samples communicate with this URL (HUILoader, Genpack). The request followed 1 redirect before landing. This is a point-in-time observation from 24 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
http://creativecommons.org/licenses/by/3.0/ - Domain: creativecommons.org · IP: 104.20.6.134 · AS13335 · US
- Server: cloudflare
- Page title: Deed - Attribution 3.0 Unported - Creative Commons
- HTTP status: 200 · text/html
- Registrar: Gandi SAS · domain age 9351 days · created 2001-01-15
- TLS issuer: C=US, O=Google Trust Services, CN=WE1 · valid to Oct 1 18: · subject CN=creativecommons.org
- HTTP requests captured: 4
- Scan tier: fast · observed 2026-08-24 07:02:29 UTC
Redirect chain
http://creativecommons.org/licenses/by/3.0/https://creativecommons.org/licenses/by/3.0/
Malware communicating with this URL (450)
These samples were observed contacting or being served from creativecommons.org. Each links to its full analysis.
- 5ed190c9c48e34f58948dc516de35de1ee679c989c6b6acc2915acde4b10b175 - referenced ·
5ed190c9c48e34f58948dc516de35de1· first seen 2026-08-24 - 216974cc4040859dfc9aacbf07d3a71adc4484fa83e6a7228e8854a2d6992e7f - referenced ·
216974cc4040859dfc9aacbf07d3a71a· first seen 2026-08-24 - HUILoader - referenced ·
6dc3b02c2f99714baef7dadbe3012f0d· first seen 2026-08-24 - Genpack - referenced ·
15422022da62b92aef659b7d3b21b128· first seen 2026-08-24 - Genpack - referenced ·
a345f0880f4d95e6c2ddbd9e7431641a· first seen 2026-08-24 - Genpack - referenced ·
a58b3ab4e70e268db674a0805ff7373f· first seen 2026-08-24 - 5ede5492e375b1281ea32bbe260136293457bfe5d1dccf2f9872f0a3d5ea804b - referenced ·
5ede5492e375b1281ea32bbe26013629· first seen 2026-08-24 - 5ed7d7bb05682782cff760b92d93a542801cebd475c906bc0d2858cf5a55d86e - referenced ·
5ed7d7bb05682782cff760b92d93a542· first seen 2026-08-24 - HUILoader - referenced ·
938c821e27c81e2ab1325a6d2661527b· first seen 2026-08-24 - b6e8b5fa383bb43957ce64b6f55454ce2285a8cc954f41c32c978eafcd6a7714 - referenced ·
b6e8b5fa383bb43957ce64b6f55454ce· first seen 2026-08-24 - b6e9587584884b0cff27204efbd740ccda5d47deb27e6261685d373974ca73e3 - referenced ·
b6e9587584884b0cff27204efbd740cc· first seen 2026-08-24 - Genpack - referenced ·
a02191c48c77f45165a963403cfaa9f8· first seen 2026-08-24 - b6e10717d2162ceec12ba8d1f56753657b0ea088dd048f756be0e64e1caa4014 - referenced ·
b6e10717d2162ceec12ba8d1f5675365· first seen 2026-08-23 - 5a49ab3c553a9f956c9db44d0685c340b87f5501050c0d665a0b770f5527eabd - referenced ·
5a49ab3c553a9f956c9db44d0685c340· first seen 2026-08-23 - fe9ec242c8e1d01a9b0e63da9b01c8c9044a88e50b5727c1aa556e3aa7f97242 - referenced ·
fe9ec242c8e1d01a9b0e63da9b01c8c9· first seen 2026-08-23
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Cloudflare
- WordPress
Contacted infrastructure
- 104.20.6.134 - AS13335 Cloudflare, Inc. (United States)
- 104.20.5.134 - AS13335 Cloudflare, Inc. (United States)
Observed indicators
- creativecommons.org
- search.creativecommons.org
- giving.gofundme.com
- wiki.creativecommons.org
- stage.creativecommons.org
- creative-commons-shop.fourthwall.com
- bsky.app
- mastodon.social
- www.facebook.com
- www.linkedin.com
- mail.creativecommons.org
- fontawesome.com
- 104.20.6.134
- 104.20.5.134
- https://creativecommons.org/licenses/by/3.0/
- https://creativecommons.org/licenses/by/3.0/deed.en
- https://creativecommons.org/licenses/by/3.0/deed.an
- https://creativecommons.org/licenses/by/3.0/deed.az
- https://creativecommons.org/licenses/by/3.0/deed.id
- https://creativecommons.org/licenses/by/3.0/deed.eu
Other scans of creativecommons.org (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown ·
https://autotools.info/index.html - 24 Aug 2026 - unknown ·
http://istana-sepeda.blogspot.com/2012/04/fork-rst-first-platinum-travel-100.html - 24 Aug 2026 - unknown ·
https://getbootstrap.com/ - 24 Aug 2026 - unknown ·
https://creativecommons.org/publicdomain/zero/1.0/ - 24 Aug 2026 - unknown ·
https://gmpg.org/xfn/11 - 23 Aug 2026 - unknown ·
http://himeaime.blogspot.com/2015/01/jodha-akbar-episode-312.html - 23 Aug 2026 - unknown ·
http://gmpg.org/xfn/11 - 23 Aug 2026 - unknown ·
https://autotools.info/index.html - 23 Aug 2026 - unknown ·
http://pandancoco.blogspot.com/2015/02/scop-281.html - 23 Aug 2026 - unknown ·
https://creativecommons.org/publicdomain/zero/1.0/
Questions about creativecommons.org
- Is creativecommons.org safe?
- The scan of creativecommons.org on 24 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with creativecommons.org?
- 450 analysed samples communicate with this URL, including HUILoader, Genpack.
- How was creativecommons.org checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of creativecommons.org
Scanned on MalwareAnalyzer by Cyble · Open interactive scan