hicoweld.com - URL scan, 24 Aug 2026
MalwareAnalyzer by Cyble scanned hicoweld.com and returned a unknown verdict (score 12). The page resolved to 27.254.152.103 on Loxinfo IP Admins in TH. The domain was registered 7557 days ago through Web Commerce Communications Limited dba WebNic.cc. 9 domains and 1 IP were contacted, over 10 HTTP requests. 4 malware samples communicate with this URL (Phishing). The request followed 1 redirect before landing. This is a point-in-time observation from 24 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 12) · Confidence 15%
- Scanned URL:
http://hicoweld.com/shop/fck_file/file/movoga.pdf - Domain: hicoweld.com · IP: 27.254.152.103 · AS63940 · TH
- Server: nginx
- Page title: ไม่พบหน้า – Hok Ziew International CO.,LTD.
- HTTP status: 404 · text/html; charset=UTF-8
- Registrar: Web Commerce Communications Limited dba WebNic.cc · domain age 7557 days · created 2005-12-14
- HTTP requests captured: 10
- Scan tier: fast · observed 2026-08-24 06:47:09 UTC
Redirect chain
http://hicoweld.com/shop/fck_file/file/movoga.pdfhttps://hicoweld.com/shop/fck_file/file/movoga.pdf
Malware communicating with this URL (4)
These samples were observed contacting or being served from hicoweld.com. Each links to its full analysis.
- Phishing - referenced ·
fc6a41169b14b564ed87c386e30315c3· first seen 2026-08-24 - Phishing - referenced ·
403225ecd5f5a4ceda6f65e6c406a1f7· first seen 2026-08-22 - Phishing - referenced ·
72ffb404edf5e7048fab777722d8df5d· first seen 2026-08-17 - Phishing - referenced ·
755e9053b26b4ddd73d49c312e654f4c· first seen 2026-08-15
Antivirus & YARA (1 of 48 engines)
- YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Why this verdict
- A signature matched text in the page (DLV_HTML_Smuggling) — pages that discuss malware can match, so this alone is not a malicious verdict
Detected technologies
- Nginx
- WordPress
- jQuery
Contacted infrastructure
- 27.254.152.103 - AS63940 Loxinfo IP Admins (TH)
Observed indicators
- hicoweld.com
- gmpg.org
- fonts.googleapis.com
- www.facebook.com
- www.hicoweld.com
- lin.ee
- shopee.co.th
- www.lazada.co.th
- www.tiktok.com
- 27.254.152.103
- https://hicoweld.com/shop/fck_file/file/movoga.pdf
- https://gmpg.org/xfn/11
- https://fonts.googleapis.com/
- https://hicoweld.com/feed/
- https://hicoweld.com/comments/feed/
- https://hicoweld.com/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.8.3
- https://fonts.googleapis.com/css?family=Work+Sans:400|DM+Serif+Display:600%2C400&display=fallback&ver=4.8.3
- https://hicoweld.com/wp-content/plugins/woocommerce/assets/client/blocks/wc-blocks.css?ver=wc-11.0.1
- https://hicoweld.com/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-layout-grid.min.css?ver=4.8.3
- https://hicoweld.com/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-smallscreen-grid.min.css?ver=4.8.3
Other scans of hicoweld.com (1)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown
Questions about hicoweld.com
- Is hicoweld.com safe?
- The scan of hicoweld.com on 24 Aug 2026 reached no verdict either way (score 12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with hicoweld.com?
- 4 analysed samples communicate with this URL, including Phishing.
- How was hicoweld.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of hicoweld.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan