herbertvanderbrugghen.nl - suspicious URL scan, 23 Aug 2026

MalwareAnalyzer by Cyble scanned herbertvanderbrugghen.nl and returned a suspicious verdict (score 34). The page resolved to 194.213.127.26 on Metaregistrar B.V. in NL. 1 domain and 1 IP were contacted, over 5 HTTP requests. The request followed 2 redirects before landing. This is a point-in-time observation from 23 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 34) · Confidence 43%
• Scanned URL: http://www.herbertvanderbrugghen.nl/draft/93767443036.pdf
• Domain: herbertvanderbrugghen.nl · IP: 194.213.127.26 · AS42585 · NL
• Server: nginx
• Page title: Page not found – architect Herbert van der Brugghen
• HTTP status: 404 · text/html; charset=UTF-8
• TLS issuer: C=US, O=Let's Encrypt, CN=YR2 · valid to Nov 15 23: · subject CN=herbertvanderbrugghen.nl
• HTTP requests captured: 5
• Scan tier: standard · observed 2026-08-23 00:35:38 UTC

Redirect chain

1. http://www.herbertvanderbrugghen.nl/draft/93767443036.pdf
2. https://www.herbertvanderbrugghen.nl/draft/93767443036.pdf
3. https://herbertvanderbrugghen.nl/draft/93767443036.pdf

Antivirus & YARA (1 of 48 engines)

• YARA: delivr.to detections [yara]: DLV_Maldoc_VBA_AutoExec (page content)

These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.

Why this verdict

• Antivirus/YARA detection in page content: DLV_Maldoc_VBA_AutoExec
• Valid TLS, no impersonation or off-origin credential post
• Cross-host redirect chain

Detected technologies

• Nginx
• PHP
• WordPress
• jQuery

Contacted infrastructure

• 194.213.127.26 - AS42585 Metaregistrar B.V. (Netherlands)

Observed indicators

• herbertvanderbrugghen.nl
• 194.213.127.26
• https://herbertvanderbrugghen.nl/draft/93767443036.pdf
• https://herbertvanderbrugghen.nl/feed/
• https://herbertvanderbrugghen.nl/comments/feed/
• https://herbertvanderbrugghen.nl/wp-content/uploads/2021/11/Gebouw.jpg
• https://herbertvanderbrugghen.nl/wp-content/plugins/svg-support/css/svgs-attachment.css
• https://herbertvanderbrugghen.nl/wp-content/themes/Avada-Child-Theme/style.css?ver=7.1
• https://herbertvanderbrugghen.nl/wp-content/uploads/fusion-styles/36cff05acdf1bccac288cd939c3544fc.min.css?ver=3.11.2
• https://herbertvanderbrugghen.nl/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
• https://herbertvanderbrugghen.nl/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
• https://herbertvanderbrugghen.nl/wp-json/
• https://herbertvanderbrugghen.nl/xmlrpc.php?rsd
• https://herbertvanderbrugghen.nl/wp-content/themes/Avada/includes/lib/assets/fonts/icomoon/awb-icons.woff
• https://herbertvanderbrugghen.nl/wp-content/themes/Avada/includes/lib/assets/fonts/fontawesome/webfonts/fa-brands-400.woff2
• https://herbertvanderbrugghen.nl/wp-content/themes/Avada/includes/lib/assets/fonts/fontawesome/webfonts/fa-regular-400.woff2
• https://herbertvanderbrugghen.nl/wp-content/themes/Avada/includes/lib/assets/fonts/fontawesome/webfonts/fa-solid-900.woff2
• https://herbertvanderbrugghen.nl/
• https://herbertvanderbrugghen.nl/wp-content/uploads/2021/11/hvdb-logo-1.svg
• https://herbertvanderbrugghen.nl/project_cat/architect/

Other scans of herbertvanderbrugghen.nl (3)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

• 23 Aug 2026 - suspicious · https://herbertvanderbrugghen.nl/draft/68566172354.pdf
• 16 Aug 2026 - suspicious · https://herbertvanderbrugghen.nl/draft/50771386205.pdf
• 3 Aug 2026 - unknown · https://herbertvanderbrugghen.nl/draft/bosonaxotiruma.pdf

Questions about herbertvanderbrugghen.nl

Is herbertvanderbrugghen.nl safe?

No. MalwareAnalyzer scanned herbertvanderbrugghen.nl on 23 Aug 2026 and returned a suspicious verdict with a score of 34 out of 100. Treat it as hostile until it is re-checked.

How was herbertvanderbrugghen.nl checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the standard tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of herbertvanderbrugghen.nl

Scanned on MalwareAnalyzer by Cyble · Open interactive scan