dermo.com - URL scan, 19 Aug 2026
MalwareAnalyzer by Cyble scanned dermo.com and returned a unknown verdict (score 12). The page resolved to 57.128.124.136 on OVH SAS in FR. The domain was registered 10305 days ago through Nominalia Internet SL. 10 domains and 1 IP were contacted, over 40 HTTP requests. 10 malware samples communicate with this URL (Phishing). The request followed 1 redirect before landing. This is a point-in-time observation from 19 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 12) · Confidence 15%
- Scanned URL:
https://dermo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614f8af15affd---femiguke.pdf - Domain: dermo.com · IP: 57.128.124.136 · AS16276 · FR
- Server: nginx
- Page title: Dermo | Fábrica de detergentes
- HTTP status: 200 · text/html; charset=UTF-8
- Registrar: Nominalia Internet SL · domain age 10305 days · created 1998-06-02
- HTTP requests captured: 40
- Scan tier: fast · observed 2026-08-19 23:31:33 UTC
Redirect chain
https://dermo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614f8af15affd---femiguke.pdfhttps://dermo.com/
Malware communicating with this URL (10)
These samples were observed contacting or being served from dermo.com. Each links to its full analysis.
- Phishing - referenced ·
fe0b308e3c940d40a69e15543274a9d7· first seen 2026-08-19 - Phishing - referenced ·
266e3a3c6930bb864dc417c8a4af0d47· first seen 2026-08-19 - Phishing - referenced ·
7089be0946284e9ec090325f8d95479e· first seen 2026-08-17 - Phishing - referenced ·
28272b62de34574e0ef7067736a40c31· first seen 2026-08-16 - Phishing - referenced ·
093a1ec0749fe4373391cbede3ba8112· first seen 2026-08-14 - Phishing - referenced ·
10bc9cf8470f150ab110fa7aa2a9f77f· first seen 2026-08-14 - Phishing - referenced ·
bbfde7997777e5db905a5e97fc7ca199· first seen 2026-08-14 - Phishing - referenced ·
616a02b591a3d5aaf043f4c95440c2c6· first seen 2026-08-13 - Phishing - referenced ·
b7ae18a951d0362e4230392d2b72f62b· first seen 2026-08-13 - Phishing - referenced ·
ba27ab870f3e99f4a25e27771f7fdc06· first seen 2026-08-11
Antivirus & YARA (1 of 47 engines)
- YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Why this verdict
- A signature matched text in the page (DLV_HTML_Smuggling) — pages that discuss malware can match, so this alone is not a malicious verdict
Detected technologies
- Nginx
- WordPress
- Google Analytics
- jQuery
Contacted infrastructure
- 57.128.124.136 - AS16276 OVH SAS (France)
Observed indicators
- dermo.com
- gmpg.org
- fonts.googleapis.com
- www.googletagmanager.com
- www.facebook.com
- www.youtube.com
- kaszino-world.com
- thenationonlineng.net
- brunocasinos.com.es
- www.google.com
- 57.128.124.136
- https://dermo.com/
- http://gmpg.org/xfn/11
- https://fonts.googleapis.com/
- https://www.googletagmanager.com/
- https://dermo.com/feed/
- https://dermo.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fdermo.com%2F
- https://dermo.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fdermo.com%2F&format=xml
- https://dermo.com/wp-content/cache/wpfc-minified/llyvqfc0/47a1b.css
- https://dermo.com/wp-content/cache/wpfc-minified/drrmkrdh/47a1b.css
Other scans of dermo.com (1)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 14 Aug 2026 - unknown
Questions about dermo.com
- Is dermo.com safe?
- The scan of dermo.com on 19 Aug 2026 reached no verdict either way (score 12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with dermo.com?
- 10 analysed samples communicate with this URL, including Phishing.
- How was dermo.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of dermo.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan