developer.wordpress.org - suspicious URL scan, 24 Aug 2026
MalwareAnalyzer by Cyble scanned developer.wordpress.org and returned a suspicious verdict (score 20), categorised as suspicious-infrastructure. The page resolved to 66.6.42.252 on TUMBLR, INC. in US. The domain was registered 8549 days ago through MarkMonitor Inc.. 34 domains and 2 IPs were contacted, over 23 HTTP requests. 87 malware samples communicate with this URL (Fromcharcode, Coinminer). The request followed 2 redirects before landing. This is a point-in-time observation from 24 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 20) · Confidence 32%
- Scanned URL:
https://api.w.org/ - Domain: developer.wordpress.org · IP: 66.6.42.252 · AS2635 · US
- Server: nginx
- Page title: REST API Handbook | Developer.WordPress.org
- HTTP status: 200 · text/html; charset=UTF-8
- Registrar: MarkMonitor Inc. · domain age 8549 days · created 2003-03-28
- TLS issuer: C=US, O=Let's Encrypt, CN=YE1 · valid to Oct 23 19: · subject CN=wordpress.org
- HTTP requests captured: 23
- Scan tier: fast · observed 2026-08-24 01:06:37 UTC
Redirect chain
https://api.w.org/https://api.wordpress.org/https://developer.wordpress.org/rest-api/
Malware communicating with this URL (87)
These samples were observed contacting or being served from developer.wordpress.org. Each links to its full analysis.
- 6ab308ac3b4b76697cf1b5d44a1e3eda9e23ee5dd44d7d7e069e9ba18d0c106b - referenced ·
6ab308ac3b4b76697cf1b5d44a1e3eda· first seen 2026-08-24 - b6e232457312de6171a0e002b5c937d2ff0fd9d44328e0694cd6000629262ff4 - referenced ·
b6e232457312de6171a0e002b5c937d2· first seen 2026-08-24 - 680ef9db42b81c3aad64ef789df7f0eecf6754df1bbb21bc0ec7652f06c21138 - referenced ·
680ef9db42b81c3aad64ef789df7f0ee· first seen 2026-08-23 - 913c7a8cdfd2fe432f92c39bc7b5f20b0c83185259d46a6493bb2dc595492d0e - referenced ·
913c7a8cdfd2fe432f92c39bc7b5f20b· first seen 2026-08-23 - ca9a457a10d9b9ae64bf80d9cec74f6cdfd94c5aeb541293b15a437cec245d8f - referenced ·
ca9a457a10d9b9ae64bf80d9cec74f6c· first seen 2026-08-23 - 5bcebd872926795f7903c550337ab862e9d3c6eb853752eeb27ae254682e9058 - referenced ·
5bcebd872926795f7903c550337ab862· first seen 2026-08-23 - bdf7e0de4851f166f4ffa4d5af1d5108794f41ec6acb2b754ecce7d869454b9a - referenced ·
bdf7e0de4851f166f4ffa4d5af1d5108· first seen 2026-08-23 - Fromcharcode - referenced ·
12ec07adae3a921b1d5b3579019bb34e· first seen 2026-08-23 - 88c3b2622614d70d84fa36c2772cd775e376c39b6633f6ff48a171142ac63cb3 - referenced ·
88c3b2622614d70d84fa36c2772cd775· first seen 2026-08-23 - a49a43eba9a66721d43f5cfa040d356cadd8f10f831bef2a0239a1e702300c83 - referenced ·
a49a43eba9a66721d43f5cfa040d356c· first seen 2026-08-23 - Coinminer - referenced ·
225b2f97a53020c31f8986282383848c· first seen 2026-08-22 - f9963fe38500fb5daef0b379a7aeac1ebdfef208db2854e305c51998e264a554 - referenced ·
f9963fe38500fb5daef0b379a7aeac1e· first seen 2026-08-22 - 417544f43480cc43a3f51b140dea79f7036424b1feb1f33cea45733458b23bb6 - referenced ·
417544f43480cc43a3f51b140dea79f7· first seen 2026-08-22 - d32f5c6e11ed7d02464bb91e60eb2134d7ce73cd440f2abbb54b9461bce98f0e - referenced ·
d32f5c6e11ed7d02464bb91e60eb2134· first seen 2026-08-22 - Fromcharcode - referenced ·
d32d2fc8713f7ae3123942de89aed781· first seen 2026-08-22
Antivirus & YARA (1 of 48 engines)
- YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Categories
- suspicious-infrastructure
Why this verdict
- Algorithmically-generated (DGA-like) hostname
- Valid TLS, no impersonation or off-origin credential post
- A signature matched text in the page (DLV_HTML_Smuggling) — pages that discuss malware can match, so this alone is not a malicious verdict
- Cross-host redirect chain
Detected technologies
- Nginx
- WordPress
- Google Analytics
- jQuery
Contacted infrastructure
- 66.6.42.252 - AS2635 TUMBLR, INC. (United States)
- 66.6.42.251 - AS2635 TUMBLR, INC. (United States)
Observed indicators
- developer.wordpress.org
- www.googletagmanager.com
- i0.wp.com
- c0.wp.com
- fonts.googleapis.com
- fonts.gstatic.com
- s.w.org
- wordpress.org
- learn.wordpress.org
- openverse.org
- wordpress.tv
- make.wordpress.org
- events.wordpress.org
- jobs.wordpress.net
- mercantile.wordpress.org
- en.wikipedia.org
- codex.wordpress.org
- github.com
- wordpressfoundation.org
- wordpress.com
Other scans of developer.wordpress.org (1)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 16 Aug 2026 - unknown ·
https://wordpress.org/
Questions about developer.wordpress.org
- Is developer.wordpress.org safe?
- No. MalwareAnalyzer scanned developer.wordpress.org on 24 Aug 2026 and returned a suspicious verdict with a score of 20 out of 100, categorised as suspicious-infrastructure. Treat it as hostile until it is re-checked.
- What malware is associated with developer.wordpress.org?
- 87 analysed samples communicate with this URL, including Fromcharcode, Coinminer.
- How was developer.wordpress.org checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of developer.wordpress.org
Scanned on MalwareAnalyzer by Cyble · Open interactive scan