f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com - malicious URL scan, 10 Oct 2026
MalwareAnalyzer by Cyble scanned f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com and returned a malicious verdict (score 100). The page resolved to 18.67.93.118 on Amazon.com, Inc. in US. The domain was registered 3330 days ago through GoDaddy.com, LLC. 1 domain and 1 IP were contacted. 12 malware samples communicate with this URL. This is a point-in-time observation from 10 Oct 2026; the page may have changed since.
Scan result
- Verdict: malicious (score 100) · Confidence 71%
- Scanned URL:
https://f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com/ugd/370021_d50f821724264002ab3a7516c7df828a.pdf?index=true - Domain: f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com · IP: 18.67.93.118 · AS16509 · US
- Server: openresty/1.31.1.1
- HTTP status: 200 · application/pdf
- Registrar: GoDaddy.com, LLC · domain age 3330 days · created 2017-08-28
- TLS issuer: C=US, O=Let's Encrypt, CN=YR1 · valid to Nov 16 11: · subject CN=*.filesusr.com
- Scan tier: fast · observed 2026-10-10 22:37:23 UTC
Malware communicating with this URL (12)
These samples were observed contacting or being served from f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com, and at least one was hosted here. Each links to its full analysis.
- 370021_3d6852ce9a95415da87818a420203529.pdf - referenced (hosted here) ·
ad77e10cebfb980678d5a86da8b89645· first seen 2026-08-29 - c5d40f_980422cf832d4895be9f6cb3d241fc34.pdf - referenced (hosted here) ·
f7d95c3ed122f0e63380fac5db1ef0fb· first seen 2026-08-27 - e3c460_d1bbbee19f57430d8216891ee9fd56db.pdf - referenced (hosted here) ·
18113bfe1ae67b7bda3804561b63bda7· first seen 2026-08-30 - a58b01_f5256100bf9941de8b745157e51a1f01.pdf - referenced (hosted here) ·
7394d5a376b29c0973b6b40815be8e0b· first seen 2026-10-08 - 0582e0_51cf84368de4446daf6161596c160b5f.pdf - referenced (hosted here) ·
cc4e7cba8108baf0358672bd7f2b8012· first seen 2026-08-29 - 7d1dc9_d61894387d614d70b8aab0c0181db5b6.pdf - referenced (hosted here) ·
8a058548483a9e719aab04489ea92cff· first seen 2026-08-28 - f65518_aa8432d0a775474fae10bc79e0af22b0.pdf - referenced (hosted here) ·
7230027e0317707f1023c13e95129c26· first seen 2026-09-17 - 665c20_f82989ab80ce4fe8a83a5f3f261528ff.pdf - referenced (hosted here) ·
67b34e952d04c8cbfe77bb6d6dfcc8d8· first seen 2026-10-02 - 4aae87_a72d7b5067784193ab0e39238446e8fd.pdf - referenced (hosted here) ·
d9b0819c87d07c6e824101170e0789e6· first seen 2026-09-17 - 8c0e65_3d1fb9d5c34c48a0965ba6737e8c91c5.pdf - referenced (hosted here) ·
d844768f4c0a9c0319628e0d6fde5f3f· first seen 2026-09-17 - 96564c_3b5cdc62589c44c8979608e43a4ef5ad.pdf - referenced (hosted here) ·
f510fd3a6c0963dd8c053b05e01bbca8· first seen 2026-09-07 - 694d5d_67fdc543981b4b94b16ab83a138fc41f.pdf - referenced (hosted here) ·
c290498c73be5ef1ec12536151cc722c· first seen 2026-09-07
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Hosts payload/config for 12 malware samples
- Grabbed file (370021_d50f821724264002ab3a7516c7df828a.pdf) is known malicious in the corpus
- File download routed to the malware sandbox (370021_d50f821724264002ab3a7516c7df828a.pdf)
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Amazon CloudFront
Contacted infrastructure
- 18.67.93.118 - AS16509 Amazon.com, Inc. (US)
Files served by this page
- 370021_d50f821724264002ab3a7516c7df828a.pdf ·
144e30b318275073f3f144e53e6aa444
Observed indicators
- f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com
- 18.67.93.118
- https://f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com/ugd/370021_d50f821724264002ab3a7516c7df828a.pdf?index=true
Other scans of f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 17 Oct 2026 - malicious
- 16 Oct 2026 - malicious
- 15 Oct 2026 - malicious
- 14 Oct 2026 - malicious
- 13 Oct 2026 - malicious
- 12 Oct 2026 - malicious
- 11 Oct 2026 - malicious
- 10 Oct 2026 - malicious
- 9 Oct 2026 - malicious
- 8 Oct 2026 - malicious
Questions about f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com
- Is f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com safe?
- No. MalwareAnalyzer scanned f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com on 10 Oct 2026 and returned a malicious verdict with a score of 100 out of 100. Treat it as hostile until it is re-checked.
- What malware is associated with f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com?
- 12 analysed samples communicate with this URL. At least one was served directly from this host.
- How was f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of f89c9433-75eb-4e86-90f6-61ef89f4a7e5.filesusr.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan