No. MalwareAnalyzer scanned diphong.com on 23 Aug 2026 and returned a suspicious verdict with a score of 25 out of 100, categorised as credential-harvest. Treat it as hostile until it is re-checked.

What malware is associated with diphong.com?

5 analysed samples communicate with this URL, including Phishing.

How was diphong.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

diphong.com - suspicious URL scan, 23 Aug 2026

MalwareAnalyzer by Cyble scanned diphong.com and returned a suspicious verdict (score 25), categorised as credential-harvest. The page resolved to 203.98.64.12 on YAH Holdings, LLC in US. 5 domains and 1 IP were contacted, over 17 HTTP requests. 5 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 23 Aug 2026; the page may have changed since.

Scan result

Verdict: suspicious (score 25) · Confidence 37%
Scanned URL: https://diphong.com/uploads/norivifuzoliredaro.pdf
Domain: diphong.com · IP: 203.98.64.12 · AS18450 · US
Server: LiteSpeed
Page title: Không tìm thấy trang này – CÔNG TY TNHH DI PHONG
HTTP status: 404 · text/html; charset=UTF-8
TLS issuer: C=US, O=Let's Encrypt, CN=YR1 · valid to Nov 8 00: · subject CN=*.webmail.diphong.com
HTTP requests captured: 17
Scan tier: standard · observed 2026-08-23 17:05:07 UTC

Malware communicating with this URL (5)

These samples were observed contacting or being served from diphong.com. Each links to its full analysis.

Phishing - referenced · 157e8d550e5d1608cbfca2517018ce01 · first seen 2026-08-21
Phishing - referenced · c343da35e52d5e3473ad1fd2d27d9b7e · first seen 2026-08-21
Phishing - referenced · 98fd99e7fb920c5e4c1f9efe454cfc07 · first seen 2026-08-21
Phishing - referenced · 7ae1ef09ff8add7155f764bba094d482 · first seen 2026-08-15
Phishing - referenced · b29ebf3ad633961b3bef3fd08ea2b360 · first seen 2026-08-13

Antivirus & YARA (1 of 48 engines)

YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)

These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.

Why this verdict

Credential-harvesting form
Valid TLS, no impersonation or off-origin credential post
A signature matched text in the page (DLV_HTML_Smuggling) — pages that discuss malware can match, so this alone is not a malicious verdict
Matches phishing-kit family "u-admin (uAdmin)"

Detected technologies

LiteSpeed
PHP
WordPress
jQuery

Contacted infrastructure

203.98.64.12 - AS18450 YAH Holdings, LLC (United States)

Observed indicators

diphong.com
gmpg.org
fonts.googleapis.com
cdnjs.cloudflare.com
fonts.gstatic.com
203.98.64.12
https://diphong.com/uploads/norivifuzoliredaro.pdf
https://gmpg.org/xfn/11
https://diphong.com/xmlrpc.php
https://fonts.googleapis.com/
https://diphong.com/feed/
https://diphong.com/comments/feed/
https://diphong.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.6
https://diphong.com/wp-content/themes/flatsome/assets/css/flatsome.css?ver=3.14.3
https://diphong.com/wp-content/themes/flatsome/assets/css/flatsome-shop.css?ver=3.14.3
https://diphong.com/wp-content/themes/flatsome-child/style.css?ver=3.0
https://fonts.googleapis.com/css?family=Roboto:regular,500,regular,500|Dancing+Script:regular,400&display=swap&ver=3.9
https://diphong.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
https://diphong.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
https://diphong.com/wp-json/

Questions about diphong.com

Is diphong.com safe?: No. MalwareAnalyzer scanned diphong.com on 23 Aug 2026 and returned a suspicious verdict with a score of 25 out of 100, categorised as credential-harvest. Treat it as hostile until it is re-checked.
What malware is associated with diphong.com?: 5 analysed samples communicate with this URL, including Phishing.
How was diphong.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the standard tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of diphong.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan