gmpg.org - URL scan, 21 Aug 2026
MalwareAnalyzer by Cyble scanned gmpg.org and returned a unknown verdict (score -12). The page resolved to 66.155.40.24 on Aptum Technologies in US. The domain was registered 8504 days ago through MarkMonitor Inc.. 6 domains and 1 IP were contacted. 55 malware samples communicate with this URL. This is a point-in-time observation from 21 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://gmpg.org/xfn/11 - Domain: gmpg.org · IP: 66.155.40.24 · AS13768 · US
- Server: nginx
- Page title: XFN 1.1 profile
- HTTP status: 200 · text/html; charset=UTF-8
- Registrar: MarkMonitor Inc. · domain age 8504 days · created 2003-05-10
- TLS issuer: C=US, O=Let's Encrypt, CN=YR2 · valid to Nov 15 21: · subject CN=gmpg.org
- Scan tier: fast · observed 2026-08-21 23:22:30 UTC
Malware communicating with this URL (55)
These samples were observed contacting or being served from gmpg.org. Each links to its full analysis.
- e65e744f7eefe52043e94e2e986d5c1bde88985d0fe6aae7e9dd486fc751f22a - referenced ·
e65e744f7eefe52043e94e2e986d5c1b· first seen 2026-08-21 - 64360cbe9299feda99351cd39504438b3d1409ff5ca79bf142f1d8fb134a1072 - referenced ·
64360cbe9299feda99351cd39504438b· first seen 2026-08-21 - 6640710f4d6e6e683ea4e6cc036968f08cfdf7f093bdb305a81e9e14b0c1e018 - referenced ·
6640710f4d6e6e683ea4e6cc036968f0· first seen 2026-08-21 - 49c520ba56ad02eea724847f01bb434aa5d79e54133317b19330ac5215fee3d6 - referenced ·
49c520ba56ad02eea724847f01bb434a· first seen 2026-08-21 - 3f7df2dfcd7c31da26937332797793cc53c2b519315f6b70f50659bf1ae08b28 - referenced ·
3f7df2dfcd7c31da26937332797793cc· first seen 2026-08-21 - 3f76b6dcb28c2d15abc29de9cff0bdf0629bbfae3e61608216406ed3b657d17a - referenced ·
3f76b6dcb28c2d15abc29de9cff0bdf0· first seen 2026-08-21 - 3f7efe183770e849d4c5e8830612fdcf318106dd8c123b9d8afd5b414e35d51f - referenced ·
3f7efe183770e849d4c5e8830612fdcf· first seen 2026-08-21 - d8f5b47c13986fdfe4acd5c8f9ce7e77b48c5d57141e690b5fc0003642988185 - referenced ·
d8f5b47c13986fdfe4acd5c8f9ce7e77· first seen 2026-08-21 - 97100ef65a43a578ed7691bc51d5d59d47465dbba949d73969b87ccd2bfe0f67 - referenced ·
97100ef65a43a578ed7691bc51d5d59d· first seen 2026-08-21 - 1d7a15aae919e76d9b87dd101425b0a8f7aa64bfd13755ded32ec2b8b4f67a44 - referenced ·
1d7a15aae919e76d9b87dd101425b0a8· first seen 2026-08-21 - df07910a82fe748ca7fc227c59d49a7b615e0e175595fd8893b7b2159a2c66cd - referenced ·
df07910a82fe748ca7fc227c59d49a7b· first seen 2026-08-21 - df0f6fcd2e5a2980aa8409931b33b814c8e551d794412a1060270b4c5e2951f2 - referenced ·
df0f6fcd2e5a2980aa8409931b33b814· first seen 2026-08-21 - aeb3be4f272575f3a60e6498590ea5da3c2d9372ef099bd7c4e2685b1cbf0d83 - referenced ·
aeb3be4f272575f3a60e6498590ea5da· first seen 2026-08-21 - df0e5e83296ac5db4b7224b55b03ae67d6f6970a4126a153967e7af0ee4e75c5 - referenced ·
df0e5e83296ac5db4b7224b55b03ae67· first seen 2026-08-21 - df03ee4e328b8f9fa61dae5e69827133c02d4133d41e03bc665666f1910ed930 - referenced ·
df03ee4e328b8f9fa61dae5e69827133· first seen 2026-08-21
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Nginx
Contacted infrastructure
- 66.155.40.24 - AS13768 Aptum Technologies (United States)
Observed indicators
- gmpg.org
- tantek.com
- photomatt.net
- meyerweb.com
- www.w3.org
- creativecommons.org
- 66.155.40.24
- https://gmpg.org/xfn/11
- https://gmpg.org/xfn/default.css
- https://gmpg.org/xfn/
- https://gmpg.org/xfn/intro
- https://gmpg.org/xfn/faq
- http://tantek.com/
- http://photomatt.net/
- http://meyerweb.com/
- http://www.w3.org/TR/html401/struct/global.html#h-7.4.4.3
- http://www.w3.org/TR/html401/struct/links.html#adef-rel
- https://gmpg.org/xfn/thanks
- http://creativecommons.org/licenses/by-nd/2.0/
Other scans of gmpg.org (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown ·
https://www.e.sg/ - 24 Aug 2026 - unknown ·
http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/4c35mk778f40i8dmtv3nkn - 24 Aug 2026 - unknown ·
https://m-styleauto.com/js/upload/files/suxomajapako.pdf - 24 Aug 2026 - suspicious ·
https://goactive.hu/wp-content/plugins/super-forms/uploads/php/files/a60475b369c455be45ab061ab56a96a - 24 Aug 2026 - unknown ·
https://smarttactic.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1607bfca797ce2- - 24 Aug 2026 - unknown ·
https://main.mdsalon.ru/ - 24 Aug 2026 - unknown ·
https://alompar.hu/uploads/content_files/files/41377062345.pdf - 24 Aug 2026 - unknown ·
https://alompar.hu/uploads/content_files/files/41377062345.pdf - 24 Aug 2026 - unknown ·
https://www.alexoloughlinonline.com/author/admin/ - 24 Aug 2026 - unknown ·
https://www.alexoloughlinonline.com/hawaii-five-0-pilot-clip/
Questions about gmpg.org
- Is gmpg.org safe?
- The scan of gmpg.org on 21 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with gmpg.org?
- 55 analysed samples communicate with this URL.
- How was gmpg.org checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of gmpg.org
Scanned on MalwareAnalyzer by Cyble · Open interactive scan