ecobox.eng.br - malicious URL scan, 20 Aug 2026
MalwareAnalyzer by Cyble scanned ecobox.eng.br and returned a malicious verdict (score 90), categorised as phishing. The page resolved to 177.12.171.183 on Cyberweb Networks Ltda in BR. 3 domains and 1 IP were contacted, over 13 HTTP requests. 9 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.
Scan result
- Verdict: malicious (score 90) · Confidence 96%
- Scanned URL:
https://ecobox.eng.br/wp-content/plugins/super-forms/uploads/php/files/cbhjkh7rp0qbnqvdn48clhpal9/30313611768.pdf - Domain: ecobox.eng.br · IP: 177.12.171.183 · AS28299 · BR
- Server: Apache
- Page title: Página não encontrada – Ecobox
- HTTP status: 404 · text/html; charset=UTF-8
- HTTP requests captured: 13
- Scan tier: fast · observed 2026-08-20 23:42:11 UTC
Malware communicating with this URL (9)
These samples were observed contacting or being served from ecobox.eng.br. Each links to its full analysis.
- Phishing - referenced ·
7ac2c9010089b2ab8a532ccd06113974· first seen 2026-08-20 - Phishing - referenced ·
4a94fda95c623c134f6c5d53317c49c6· first seen 2026-08-17 - Phishing - referenced ·
ffa9d10c686ff21451353a69347915cb· first seen 2026-08-16 - Phishing - referenced ·
f25881aaca466491d203e122e0e3a3b4· first seen 2026-08-16 - Phishing - referenced ·
c927369342973435b7ef4090c22b8786· first seen 2026-08-15 - Phishing - referenced ·
8bc368ccd5083fac257c861586effdb9· first seen 2026-08-15 - Phishing - referenced ·
9f492afd5688c7930f8bf858d2582a68· first seen 2026-08-15 - Phishing - referenced ·
5b89c8669a974fd097cb8c14d6c62e84· first seen 2026-08-15 - Phishing - referenced ·
7c0af553c36b2185a6a83f30b95c01bb· first seen 2026-08-14
Antivirus & YARA (2 of 47 engines)
- YARA: SophosLabs IoCs (public) [yara]: SOPHOS_Gootloader_JS (page content)
- YARA: Stratosphere IPS [yara]: STRATO_Tor_Onion_C2 (page content)
Categories
- phishing
Why this verdict
- 2 antivirus/YARA engines flagged the page content: STRATO_Tor_Onion_C2, SOPHOS_Gootloader_JS
- Domain impersonates ing (typosquat)
Detected technologies
- Apache
- WordPress
- jQuery
Contacted infrastructure
- 177.12.171.183 - AS28299 Cyberweb Networks Ltda (Brazil)
Observed indicators
- ecobox.eng.br
- gmpg.org
- fonts.googleapis.com
- 177.12.171.183
- https://ecobox.eng.br/wp-content/plugins/super-forms/uploads/php/files/cbhjkh7rp0qbnqvdn48clhpal9/30313611768.pdf
- https://gmpg.org/xfn/11
- https://ecobox.eng.br/feed/
- https://ecobox.eng.br/comments/feed/
- https://ecobox.eng.br/wp-includes/css/dist/block-library/style.css?ver=7.1
- https://ecobox.eng.br/wp-content/themes/hello-elementor/assets/css/reset.css?ver=3.4.9
- https://ecobox.eng.br/wp-content/themes/hello-elementor/assets/css/theme.css?ver=3.4.9
- https://ecobox.eng.br/wp-content/themes/hello-elementor/assets/css/header-footer.css?ver=3.4.9
- https://ecobox.eng.br/wp-content/plugins/elementor/assets/css/frontend.css?ver=4.2.3
- https://ecobox.eng.br/wp-content/uploads/elementor/css/post-92.css?ver=1787248632
- https://ecobox.eng.br/wp-content/plugins/elementskit-lite/widgets/init/assets/css/common.css?ver=4.0.1
- https://ecobox.eng.br/wp-content/plugins/elementskit-lite/widgets/init/assets/css/nav-menu.css?ver=4.0.1
- https://ecobox.eng.br/wp-content/plugins/elementskit-lite/widgets/init/assets/css/header-search.css?ver=4.0.1
- https://ecobox.eng.br/wp-content/plugins/elementskit-lite/widgets/init/assets/css/header-offcanvas.css?ver=4.0.1
- https://ecobox.eng.br/wp-content/plugins/elementskit-lite/widgets/init/assets/css/header-info.css?ver=4.0.1
- https://fonts.googleapis.com/css?family=Outfit:100,100italic,200,200italic,300,300italic,400,400italic,500,500italic,600,600italic,700,700italic,800,800italic,900,900italic&display=swap
Questions about ecobox.eng.br
- Is ecobox.eng.br safe?
- No. MalwareAnalyzer scanned ecobox.eng.br on 20 Aug 2026 and returned a malicious verdict with a score of 90 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.
- What malware is associated with ecobox.eng.br?
- 9 analysed samples communicate with this URL, including Phishing.
- How was ecobox.eng.br checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of ecobox.eng.br
Scanned on MalwareAnalyzer by Cyble · Open interactive scan