email.com - suspicious URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned email.com and returned a suspicious verdict (score 35), categorised as phishing. The page resolved to 31.43.161.6 on Framer B.V. in NL. The domain was registered 10566 days ago through Register.com - Network Solutions, LLC. 6 domains and 1 IP were contacted, over 2 HTTP requests. 8 malware samples communicate with this URL. This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 35) · Confidence 38%
- Scanned URL:
https://email.com/ - Domain: email.com · IP: 31.43.161.6 · AS16509 · NL
- Server: Framer/6443c08
- Page title: Email.com | Email Inbox AI
- HTTP status: 200 · text/html
- Registrar: Register.com - Network Solutions, LLC · domain age 10566 days · created 1997-09-17
- TLS issuer: C=US, O=Let's Encrypt, CN=YE2 · valid to Oct 17 04: · subject CN=email.com
- HTTP requests captured: 2
- Scan tier: fast · observed 2026-08-22 05:07:20 UTC
Malware communicating with this URL (8)
These samples were observed contacting or being served from email.com. Each links to its full analysis.
- 6a09c076a07f7ee6358335924b016a814568ded90f013f47027e68e51a2aabb6 - referenced ·
6a09c076a07f7ee6358335924b016a81· first seen 2026-08-22 - 3f7899ba69ccc7a23a418c62625e579ea9d406b1d02e28768d5cf8b18bc1d7d6 - referenced ·
3f7899ba69ccc7a23a418c62625e579e· first seen 2026-08-21 - 323b09a0dc664b18338036d2546899d907c218fdea8ed75bcf0d3452640d0aa2 - referenced ·
323b09a0dc664b18338036d2546899d9· first seen 2026-08-21 - df066392d67063967325fcddf0440399235a135700429a5a238539f363b2ef67 - referenced ·
df066392d67063967325fcddf0440399· first seen 2026-08-21 - df0d093b69189150a507865b74bef77ada93cb7dcd8299383c9eb0f4d53f598b - referenced ·
df0d093b69189150a507865b74bef77a· first seen 2026-08-21 - 99069d33ec4f87abf797c9591435e7a3d904d138ed0098fb5e78b72a9b9bf8df - referenced ·
99069d33ec4f87abf797c9591435e7a3· first seen 2026-08-20 - bb2ae3799510ca93c722c34c1c202da1c336b755b1df87fc800ef041f1412ba9 - referenced ·
bb2ae3799510ca93c722c34c1c202da1· first seen 2026-08-13 - 80e28ed36855fbe2d4014c04b9db6df7540f644c5dc75853818e8bab77c28eb3 - referenced ·
80e28ed36855fbe2d4014c04b9db6df7· first seen 2026-08-13
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Categories
- phishing
Why this verdict
- Domain impersonates gmail (typosquat)
Contacted infrastructure
- 31.43.161.6 - AS16509 Framer B.V. (Netherlands)
Observed indicators
- email.com
- framerusercontent.com
- framer.com
- fonts.gstatic.com
- events.framer.com
- www.linkedin.com
- 31.43.161.6
- https://email.com/
- https://framerusercontent.com/images/rlUWs4rY6tFj8NLPx7cfqCIsMVk.svg
- https://framerusercontent.com/images/58RjCCOtRSIqhMKg18889X0rGF8.png
- https://framer.com/edit/init.mjs
- https://fonts.gstatic.com/
- https://events.framer.com/script?v=2
- https://framerusercontent.com/images/kFRkaFwV5sWiTyfIHFghNb2BOc.jpg?width=1920&height=1080
- https://www.linkedin.com/company/companydotai/jobs/
- https://framerusercontent.com/images/x7Dy8Nl2ZftFPcCwfNkhC7eCNQ.png?width=650&height=164
- https://framerusercontent.com/images/fk5bWHgPoSbmtOm3zEYuHdd3c.png?width=1733&height=231
- https://framerusercontent.com/images/7Q5JaSWk8r0XiK6QVXsET4MYmY.png?width=2160&height=711
- https://framerusercontent.com/images/jeeNel0N5ipYoaxCRjh5si2jFWU.png?width=1510&height=405
- https://framerusercontent.com/images/wMONWqpqYxHaQL1Ons9AhNvs3FA.png?width=628&height=200
Questions about email.com
- Is email.com safe?
- No. MalwareAnalyzer scanned email.com on 22 Aug 2026 and returned a suspicious verdict with a score of 35 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.
- What malware is associated with email.com?
- 8 analysed samples communicate with this URL.
- How was email.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of email.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan