gulertrafik.com - suspicious URL scan, 23 Aug 2026
MalwareAnalyzer by Cyble scanned gulertrafik.com and returned a suspicious verdict (score 40). The page resolved to 77.37.87.253 on netutils-mnt in FR. The domain was registered 4097 days ago through Cloudflare, Inc.. 1 domain and 1 IP were contacted, over 1 HTTP request. 7 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 23 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 40) · Confidence 43%
- Scanned URL:
https://gulertrafik.com/wp-content/plugins/super-forms/uploads/php/files/m1ba3gu4ndvja6ltap19mffooe/dewedafekafebifofalideb.pdf - Domain: gulertrafik.com · IP: 77.37.87.253 · AS47583 · FR
- Server: nginx/1.24.0 (Ubuntu)
- Page title: Zido HACCP APP — Sécurité Alimentaire & Contrôle Sanitaire
- HTTP status: 200 · text/html
- Registrar: Cloudflare, Inc. · domain age 4097 days · created 2015-06-05
- HTTP requests captured: 1
- Scan tier: fast · observed 2026-08-23 08:31:42 UTC
Malware communicating with this URL (7)
These samples were observed contacting or being served from gulertrafik.com. Each links to its full analysis.
- Phishing - referenced ·
727d01cf7f469f14704182e4802b68b9· first seen 2026-08-23 - Phishing - referenced ·
e9eb6402c27e41eb80a98ac7198c7827· first seen 2026-08-20 - Phishing - referenced ·
58eb61a1092238543b5b81844a071673· first seen 2026-08-20 - Phishing - referenced ·
67c3e6c480c25395bb13617131b85d81· first seen 2026-08-19 - Phishing - referenced ·
dc3f8582edd3c6a7e0a86787f9449b53· first seen 2026-08-17 - Phishing - referenced ·
444d0e04ce5b9337572c54caecea0338· first seen 2026-08-15 - Phishing - referenced ·
9141ac7cabfded9a32702c4d28a5ecb4· first seen 2026-08-13
Antivirus & YARA (1 of 48 engines)
- YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Why this verdict
- Antivirus/YARA detection in page content: DLV_HTML_Smuggling
Detected technologies
- Nginx
Contacted infrastructure
- 77.37.87.253 - AS47583 netutils-mnt (FR)
Observed indicators
- gulertrafik.com
- 77.37.87.253
- https://gulertrafik.com/wp-content/plugins/super-forms/uploads/php/files/m1ba3gu4ndvja6ltap19mffooe/dewedafekafebifofalideb.pdf
- https://gulertrafik.com/logo.png
- https://gulertrafik.com/assets/index-DBz7CFaC.css
- https://gulertrafik.com/assets/responsive-v108.css
- https://gulertrafik.com/assets/index-v108.js
Questions about gulertrafik.com
- Is gulertrafik.com safe?
- No. MalwareAnalyzer scanned gulertrafik.com on 23 Aug 2026 and returned a suspicious verdict with a score of 40 out of 100. Treat it as hostile until it is re-checked.
- What malware is associated with gulertrafik.com?
- 7 analysed samples communicate with this URL, including Phishing.
- How was gulertrafik.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of gulertrafik.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan