gmpg.org - URL scan, 20 Aug 2026
MalwareAnalyzer by Cyble scanned gmpg.org and returned a unknown verdict (score -12). The page resolved to 66.155.40.24 on Aptum Technologies in US. The domain was registered 8503 days ago through MarkMonitor Inc.. 6 domains and 1 IP were contacted. 34 malware samples communicate with this URL (Fromcharcode, Group10). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://gmpg.org/xfn/11 - Domain: gmpg.org · IP: 66.155.40.24 · AS13768 · US
- Server: nginx
- Page title: XFN 1.1 profile
- HTTP status: 200 · text/html; charset=UTF-8
- Registrar: MarkMonitor Inc. · domain age 8503 days · created 2003-05-10
- TLS issuer: C=US, O=Let's Encrypt, CN=YR2 · valid to Nov 15 21: · subject CN=gmpg.org
- Scan tier: fast · observed 2026-08-20 21:02:19 UTC
Malware communicating with this URL (34)
These samples were observed contacting or being served from gmpg.org. Each links to its full analysis.
- Fromcharcode - referenced ·
05c06067501ee8d6deeb80a58ef04885· first seen 2026-08-20 - dccc3764396fbd5bf8b7c4ac78c44d81309f3a5100354e041bacc91ef2797ecd - referenced ·
dccc3764396fbd5bf8b7c4ac78c44d81· first seen 2026-08-20 - 990c7e6e27143ae2760fbd1038c319dc58748ad79b7f51d49c0771d186655517 - referenced ·
990c7e6e27143ae2760fbd1038c319dc· first seen 2026-08-20 - 990f8b08e4065c66728b6c5d5ee0a615515f75b538fbaed37d3bfd4ca6a9415d - referenced ·
990f8b08e4065c66728b6c5d5ee0a615· first seen 2026-08-20 - 5eb6f3d81081997ecb17f86f50073304fee03c9eb2ccd0ae5fc113abad0233e0 - referenced ·
5eb6f3d81081997ecb17f86f50073304· first seen 2026-08-20 - 9903cbba4e782c65ac80c3f70f11b8014308916c9b6eb15ee0b0c01cb27dc325 - referenced ·
9903cbba4e782c65ac80c3f70f11b801· first seen 2026-08-20 - 99092c55bf6f34ede9b3d45f26cb7d2320704015d4418c3d52d99f026e664b5d - referenced ·
99092c55bf6f34ede9b3d45f26cb7d23· first seen 2026-08-20 - 9908891aa1cecbde7b0504927f1015d7f9375000173e6996c6e72ef8ab3c14a3 - referenced ·
9908891aa1cecbde7b0504927f1015d7· first seen 2026-08-20 - f21c317d56b52b69bdb4ca274641957174445eee9becb32ee3738ca48e49b8cf - referenced ·
f21c317d56b52b69bdb4ca2746419571· first seen 2026-08-20 - 99077cc33cbd824fd83e55fed4a3ebe7bd54a23c0f0413fe79cbfd2e4ee724a4 - referenced ·
99077cc33cbd824fd83e55fed4a3ebe7· first seen 2026-08-20 - 3e45dd6f1e5cd1cebed108e753617320eef7f051f37ee33c6b166719088a1b6a - referenced ·
3e45dd6f1e5cd1cebed108e753617320· first seen 2026-08-19 - 0b2cb9131056cba3149b8b37baa44084504864b8a4bb8b403e4ab24c32df8d43 - referenced ·
0b2cb9131056cba3149b8b37baa44084· first seen 2026-08-19 - 6ad27850b47d99aa4200fa367d481cff9e6e4f5a71a1f9aeec2c4558ab729412 - referenced ·
6ad27850b47d99aa4200fa367d481cff· first seen 2026-08-17 - Group10 - referenced ·
36090ae208ae7e37b2cd9b2f269f080e· first seen 2026-08-17 - 9fff1a774a85a191dd95c19f580cb9c108a3b15f35b81ca6026a59449a74f33f - referenced ·
9fff1a774a85a191dd95c19f580cb9c1· first seen 2026-08-17
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Nginx
Contacted infrastructure
- 66.155.40.24 - AS13768 Aptum Technologies (United States)
Observed indicators
- gmpg.org
- tantek.com
- photomatt.net
- meyerweb.com
- www.w3.org
- creativecommons.org
- 66.155.40.24
- https://gmpg.org/xfn/11
- https://gmpg.org/xfn/default.css
- https://gmpg.org/xfn/
- https://gmpg.org/xfn/intro
- https://gmpg.org/xfn/faq
- http://tantek.com/
- http://photomatt.net/
- http://meyerweb.com/
- http://www.w3.org/TR/html401/struct/global.html#h-7.4.4.3
- http://www.w3.org/TR/html401/struct/links.html#adef-rel
- https://gmpg.org/xfn/thanks
- http://creativecommons.org/licenses/by-nd/2.0/
Other scans of gmpg.org (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown ·
https://www.lsv-wittlage.de/ckfinder/userfiles/files/rigefivijafiziw.pdf - 24 Aug 2026 - unknown ·
https://www.lsv-wittlage.de/ckfinder/userfiles/files/rigefivijafiziw.pdf - 24 Aug 2026 - unknown ·
https://www.e.sg/ - 24 Aug 2026 - unknown ·
http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/4c35mk778f40i8dmtv3nkn - 24 Aug 2026 - unknown ·
https://m-styleauto.com/js/upload/files/suxomajapako.pdf - 24 Aug 2026 - suspicious ·
https://goactive.hu/wp-content/plugins/super-forms/uploads/php/files/a60475b369c455be45ab061ab56a96a - 24 Aug 2026 - unknown ·
https://smarttactic.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1607bfca797ce2- - 24 Aug 2026 - unknown ·
https://main.mdsalon.ru/ - 24 Aug 2026 - unknown ·
https://alompar.hu/uploads/content_files/files/41377062345.pdf - 24 Aug 2026 - unknown ·
https://alompar.hu/uploads/content_files/files/41377062345.pdf
Questions about gmpg.org
- Is gmpg.org safe?
- The scan of gmpg.org on 20 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with gmpg.org?
- 34 analysed samples communicate with this URL, including Fromcharcode, Group10.
- How was gmpg.org checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of gmpg.org
Scanned on MalwareAnalyzer by Cyble · Open interactive scan