Is gbooking.runsystem.work safe?

No. MalwareAnalyzer scanned gbooking.runsystem.work on 20 Aug 2026 and returned a suspicious verdict with a score of 22 out of 100, categorised as suspicious-infrastructure. Treat it as hostile until it is re-checked.

How was gbooking.runsystem.work checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

gbooking.runsystem.work - suspicious URL scan, 20 Aug 2026

MalwareAnalyzer by Cyble scanned gbooking.runsystem.work and returned a suspicious verdict (score 22), categorised as suspicious-infrastructure. The page resolved to 64.91.249.184 on BrickHost in US. The domain was registered 2224 days ago through GMO Internet, Inc. d/b/a Onamae.com. 5 domains and 5 IPs were contacted, over 31 HTTP requests. This is a point-in-time observation from 20 Aug 2026; the page may have changed since.

Scan result

Verdict: suspicious (score 22) · Confidence 34%
Scanned URL: https://gbooking.runsystem.work/
Domain: gbooking.runsystem.work · IP: 64.91.249.184 · AS32244 · US
Server: Apache
HTTP status: 301 · text/html; charset=UTF-8
Registrar: GMO Internet, Inc. d/b/a Onamae.com · domain age 2224 days · created 2020-07-17
Registrant country: JP
TLS issuer: C=US, O=Let's Encrypt, CN=YR2 · valid to Nov 17 21: · subject CN=gbooking.runsystem.work
HTTP requests captured: 31 · cookies set: 1 · outgoing links: 5
Scan tier: standard · observed 2026-08-20 21:42:13 UTC

Why this verdict

Algorithmically-generated (DGA-like) hostname
Abuse-heavy TLD .work
Valid TLS, no impersonation or off-origin credential post
Certificate issued < 48h ago

Detected technologies

Apache

Contacted infrastructure

64.91.249.184 - AS32244 BrickHost (United States)
104.17.208.5 - AS13335 Cloudflare, Inc. (United States)
103.180.114.1 - AS200325 BUNNYWAY, informacijske storitve d.o.o (Australia)
104.17.25.14 - AS13335 Cloudflare, Inc. (United States)

Observed indicators

gbooking.runsystem.work
code.jquery.com
cdn.jsdelivr.net
cdn.bookedscheduler.com
cdnjs.cloudflare.com
64.91.249.184
151.101.1.155
104.17.208.5
103.180.114.1
104.17.25.14
https://gbooking.runsystem.work/

Questions about gbooking.runsystem.work

Is gbooking.runsystem.work safe?: No. MalwareAnalyzer scanned gbooking.runsystem.work on 20 Aug 2026 and returned a suspicious verdict with a score of 22 out of 100, categorised as suspicious-infrastructure. Treat it as hostile until it is re-checked.
How was gbooking.runsystem.work checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the standard tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of gbooking.runsystem.work

Scanned on MalwareAnalyzer by Cyble · Open interactive scan