flyags.com - suspicious URL scan, 24 Aug 2026
MalwareAnalyzer by Cyble scanned flyags.com and returned a suspicious verdict (score 28), categorised as credential-harvest. The page resolved to 35.212.70.243 on Google LLC in US. 16 domains and 1 IP were contacted, over 15 HTTP requests. 5 malware samples communicate with this URL (Phishing). The request followed 1 redirect before landing. This is a point-in-time observation from 24 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 28) · Confidence 37%
- Scanned URL:
https://flyags.com/editorResources/file///47360693342.pdf - Domain: flyags.com · IP: 35.212.70.243 · AS19527 · US
- Server: nginx
- Page title: Page not found - Augusta Regional Airport
- HTTP status: 404 · text/html; charset=UTF-8
- TLS issuer: C=US, O=Let's Encrypt, CN=YR2 · valid to Nov 22 00: · subject CN=flyags.com
- HTTP requests captured: 15
- Scan tier: standard · observed 2026-08-24 07:05:10 UTC
Redirect chain
https://flyags.com/editorResources/file///47360693342.pdfhttps://flyags.com/editorResources/file/47360693342.pdf
Malware communicating with this URL (5)
These samples were observed contacting or being served from flyags.com. Each links to its full analysis.
- Phishing - referenced ·
a390e998dde8c9282bef571641c4e5b4· first seen 2026-08-21 - Phishing - referenced ·
b88ee360187be36a69cd2625f0e51cf1· first seen 2026-08-21 - Phishing - referenced ·
14b510a8a138b3f818b0f95c023aa206· first seen 2026-08-17 - Phishing - referenced ·
bbe354f59c3cfeb93111c74be71fa848· first seen 2026-08-15 - Phishing - referenced ·
84a610a75bc601a0281bbba10920991a· first seen 2026-08-14
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Categories
- credential-harvest
Why this verdict
- Credential-harvesting form
- Valid TLS, no impersonation or off-origin credential post
- Certificate issued < 48h ago
Detected technologies
- Nginx
- WordPress
- Google Analytics
- jQuery
Contacted infrastructure
- 35.212.70.243 - AS19527 Google LLC (United States)
Observed indicators
- flyags.com
- www.googletagmanager.com
- gmpg.org
- use.typekit.net
- kit.fontawesome.com
- api.glia.com
- fonts.googleapis.com
- flyags.travelserver.net
- flyags.us12.list-manage.com
- flyags.powerserve.net
- goo.gl
- www.facebook.com
- instagram.com
- twitter.com
- www.youtube.com
- acsbapp.com
- 35.212.70.243
- https://flyags.com/editorResources/file/47360693342.pdf
- https://www.googletagmanager.com/gtm.js?id=
- https://gmpg.org/xfn/11
Other scans of flyags.com (3)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - suspicious
- 21 Aug 2026 - suspicious ·
https://flyags.com/editorResources/file/nularolugisewabod.pdf - 21 Aug 2026 - suspicious ·
https://flyags.com/editorResources/file/nularolugisewabod.pdf
Questions about flyags.com
- Is flyags.com safe?
- No. MalwareAnalyzer scanned flyags.com on 24 Aug 2026 and returned a suspicious verdict with a score of 28 out of 100, categorised as credential-harvest. Treat it as hostile until it is re-checked.
- What malware is associated with flyags.com?
- 5 analysed samples communicate with this URL, including Phishing.
- How was flyags.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the standard tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of flyags.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan