gmpg.org - URL scan, 21 Aug 2026
MalwareAnalyzer by Cyble scanned gmpg.org and returned a unknown verdict (score 6). The page resolved to 66.155.40.24 on Aptum Technologies in US. The domain was registered 8503 days ago through MarkMonitor Inc.. 6 domains and 1 IP were contacted. 44 malware samples communicate with this URL (Obfus, Fromcharcode). This is a point-in-time observation from 21 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 6) · Confidence 9%
- Scanned URL:
http://gmpg.org/xfn/11 - Domain: gmpg.org · IP: 66.155.40.24 · AS13768 · US
- Server: nginx
- Page title: XFN 1.1 profile
- HTTP status: 200 · text/html; charset=UTF-8
- Registrar: MarkMonitor Inc. · domain age 8503 days · created 2003-05-10
- Scan tier: fast · observed 2026-08-21 04:27:21 UTC
Malware communicating with this URL (44)
These samples were observed contacting or being served from gmpg.org. Each links to its full analysis.
- df0f6fcd2e5a2980aa8409931b33b814c8e551d794412a1060270b4c5e2951f2 - referenced ·
df0f6fcd2e5a2980aa8409931b33b814· first seen 2026-08-21 - aeb3be4f272575f3a60e6498590ea5da3c2d9372ef099bd7c4e2685b1cbf0d83 - referenced ·
aeb3be4f272575f3a60e6498590ea5da· first seen 2026-08-21 - df0e5e83296ac5db4b7224b55b03ae67d6f6970a4126a153967e7af0ee4e75c5 - referenced ·
df0e5e83296ac5db4b7224b55b03ae67· first seen 2026-08-21 - df03ee4e328b8f9fa61dae5e69827133c02d4133d41e03bc665666f1910ed930 - referenced ·
df03ee4e328b8f9fa61dae5e69827133· first seen 2026-08-21 - df0adde3666026c9cd5aa16fc35725e5ffe5243d799a6f31bad08045fb733d47 - referenced ·
df0adde3666026c9cd5aa16fc35725e5· first seen 2026-08-21 - Obfus - referenced ·
e0dbf82caffa7267f46f644a40bc4508· first seen 2026-08-21 - b3beee47076d757137554201971cda773e82e804b3510f16de53766c0e29b45d - referenced ·
b3beee47076d757137554201971cda77· first seen 2026-08-21 - dcc0268741419a6e702c61395e659b578321db39475b92fc9c7699fc53db0dae - referenced ·
dcc0268741419a6e702c61395e659b57· first seen 2026-08-20 - 7ae4783fdc8b63a34bc2598b1a42a692fa5a02de3feb995a3f53d101815b6fdb - referenced ·
7ae4783fdc8b63a34bc2598b1a42a692· first seen 2026-08-20 - 52160a8d8c87775468d63eb934798d520438ce5bd8e365c04339464b4ae61807 - referenced ·
52160a8d8c87775468d63eb934798d52· first seen 2026-08-20 - Fromcharcode - referenced ·
05c06067501ee8d6deeb80a58ef04885· first seen 2026-08-20 - dccc3764396fbd5bf8b7c4ac78c44d81309f3a5100354e041bacc91ef2797ecd - referenced ·
dccc3764396fbd5bf8b7c4ac78c44d81· first seen 2026-08-20 - 990c7e6e27143ae2760fbd1038c319dc58748ad79b7f51d49c0771d186655517 - referenced ·
990c7e6e27143ae2760fbd1038c319dc· first seen 2026-08-20 - 990f8b08e4065c66728b6c5d5ee0a615515f75b538fbaed37d3bfd4ca6a9415d - referenced ·
990f8b08e4065c66728b6c5d5ee0a615· first seen 2026-08-20 - 5eb6f3d81081997ecb17f86f50073304fee03c9eb2ccd0ae5fc113abad0233e0 - referenced ·
5eb6f3d81081997ecb17f86f50073304· first seen 2026-08-20
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Served over plaintext HTTP
Detected technologies
- Nginx
Contacted infrastructure
- 66.155.40.24 - AS13768 Aptum Technologies (United States)
Observed indicators
- gmpg.org
- tantek.com
- photomatt.net
- meyerweb.com
- www.w3.org
- creativecommons.org
- 66.155.40.24
- http://gmpg.org/xfn/11
- http://gmpg.org/xfn/default.css
- http://gmpg.org/xfn/
- http://gmpg.org/xfn/intro
- http://gmpg.org/xfn/faq
- http://tantek.com/
- http://photomatt.net/
- http://meyerweb.com/
- http://www.w3.org/TR/html401/struct/global.html#h-7.4.4.3
- http://www.w3.org/TR/html401/struct/links.html#adef-rel
- http://gmpg.org/xfn/thanks
- http://creativecommons.org/licenses/by-nd/2.0/
Other scans of gmpg.org (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown ·
https://opensource.org/license/MIT - 24 Aug 2026 - unknown ·
https://otpetye.com/images/shared/file/pujudobobojexij.pdf - 24 Aug 2026 - unknown ·
https://kfk-dekoration.dk/images/uploadedimages/file/navukopizutazaj.pdf - 24 Aug 2026 - unknown ·
https://maxflowfans.com/userfiles/file/deregulobirofix.pdf - 24 Aug 2026 - unknown ·
https://maxflowfans.com/userfiles/file/deregulobirofix.pdf - 24 Aug 2026 - unknown ·
https://manhremhoangvan.com/wp-content/uploads/files/zezumemesodetoros.pdf - 24 Aug 2026 - unknown ·
http://eng.sut.ac.th/tce/2016/administrator/ckfinder/userfiles/files/49307295506.pdf - 24 Aug 2026 - suspicious ·
https://manhremhoangvan.com/wp-content/uploads/files/zezumemesodetoros.pdf - 24 Aug 2026 - unknown ·
http://eng.sut.ac.th/tce/2016/administrator/ckfinder/userfiles/files/49307295506.pdf - 24 Aug 2026 - suspicious ·
https://flyags.com/editorResources/file/47360693342.pdf
Questions about gmpg.org
- Is gmpg.org safe?
- The scan of gmpg.org on 21 Aug 2026 reached no verdict either way (score 6). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with gmpg.org?
- 44 analysed samples communicate with this URL, including Obfus, Fromcharcode.
- How was gmpg.org checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of gmpg.org
Scanned on MalwareAnalyzer by Cyble · Open interactive scan