Is crm.protocollobnb.com safe?

No. MalwareAnalyzer scanned crm.protocollobnb.com on 22 Aug 2026 and returned a malicious verdict with a score of 77 out of 100. Treat it as hostile until it is re-checked.

How was crm.protocollobnb.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

crm.protocollobnb.com - malicious URL scan, 22 Aug 2026

MalwareAnalyzer by Cyble scanned crm.protocollobnb.com and returned a malicious verdict (score 77). The page resolved to 185.158.133.1 on Internet Utilities Europe and Asia Limited in PL. The domain was registered 1486 days ago through GoDaddy.com, LLC. 5 domains and 4 IPs were contacted, over 15 HTTP requests. This is a point-in-time observation from 22 Aug 2026; the page may have changed since.

Scan result

Verdict: malicious (score 77) · Confidence 83%
Scanned URL: https://crm.protocollobnb.com/
Domain: crm.protocollobnb.com · IP: 185.158.133.1 · AS13335 · PL
Server: cloudflare
Page title: PBNB CRM
HTTP status: 200 · text/html; charset=utf-8
Registrar: GoDaddy.com, LLC · domain age 1486 days · created 2022-07-27
TLS issuer: C=US, O=Google Trust Services, CN=WE1 · valid to Sep 22 09: · subject CN=crm.protocollobnb.com
HTTP requests captured: 15 · cookies set: 3
Scan tier: standard · observed 2026-08-22 06:45:00 UTC

Antivirus & YARA (1 of 48 engines)

YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)

Why this verdict

Antivirus/YARA detection in page content: DLV_HTML_Smuggling
Runtime data beacon to ycmtjwsmugksarwajllc.supabase.co

Detected technologies

Cloudflare

Contacted infrastructure

185.158.133.1 - AS13335 Internet Utilities Europe and Asia Limited (Poland)
157.240.13.19 - AS32934 Facebook, Inc. (Singapore)
172.64.149.246 - AS13335 Cloudflare, Inc. (United States)

Observed indicators

crm.protocollobnb.com
fonts.googleapis.com
fonts.gstatic.com
connect.facebook.net
ycmtjwsmugksarwajllc.supabase.co
185.158.133.1
142.250.195.138
157.240.13.19
172.64.149.246
https://crm.protocollobnb.com/
https://crm.protocollobnb.com/app-icon.png
https://crm.protocollobnb.com/manifest.json
https://fonts.googleapis.com/
https://fonts.gstatic.com/
https://fonts.googleapis.com/css2?family=Montserrat:wght@500;600&family=Space+Grotesk:wght@400;500;600;700&display=swap
https://crm.protocollobnb.com/assets/index-RLxRuFPX.js
https://crm.protocollobnb.com/assets/index-BOTVpGcU.css
https://crm.protocollobnb.com/~flock.js

Questions about crm.protocollobnb.com

Is crm.protocollobnb.com safe?: No. MalwareAnalyzer scanned crm.protocollobnb.com on 22 Aug 2026 and returned a malicious verdict with a score of 77 out of 100. Treat it as hostile until it is re-checked.
How was crm.protocollobnb.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the standard tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of crm.protocollobnb.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan