The scan of i.ibb.co on 22 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with i.ibb.co?

4 analysed samples communicate with this URL, including Khalesi.

How was i.ibb.co checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

i.ibb.co - URL scan, 22 Aug 2026

MalwareAnalyzer by Cyble scanned i.ibb.co and returned a unknown verdict (score -12). The page resolved to 23.237.219.162 on FDCservers.net in US. 1 domain and 1 IP were contacted. 4 malware samples communicate with this URL (Khalesi). This is a point-in-time observation from 22 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score -12) · Confidence 15%
Scanned URL: https://i.ibb.co/9nnrtWy/login02-popup.png
Domain: i.ibb.co · IP: 23.237.219.162 · AS30058 · US
Server: nginx
HTTP status: 200 · image/png
TLS issuer: C=US, O=Let's Encrypt, CN=YE1 · valid to Nov 10 21: · subject CN=ibb.co
Scan tier: fast · observed 2026-08-22 10:34:58 UTC

Malware communicating with this URL (4)

These samples were observed contacting or being served from i.ibb.co. Each links to its full analysis.

51b0dabbcbea63a005a8ba5222906925f66d4e905fa889a826cc6944baa6433a - referenced · 51b0dabbcbea63a005a8ba5222906925 · first seen 2026-08-22
Khalesi - referenced · 035a6fa4064026934d0a631c9c1f1b9a · first seen 2026-08-21
Doc.Reciept.8810762.shtml - referenced · d405681d041a17b3a4d0940b3746cb36 · first seen 2026-08-21
sample - referenced · 6738463df6799b8fd8f92f8deae1e57e · first seen 2026-08-14

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Why this verdict

Valid TLS, no impersonation or off-origin credential post

Detected technologies

Nginx

Contacted infrastructure

23.237.219.162 - AS30058 FDCservers.net (United States)

Observed indicators

i.ibb.co
23.237.219.162
https://i.ibb.co/9nnrtWy/login02-popup.png

Other scans of i.ibb.co (8)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

23 Aug 2026 - unknown · https://izin-google-naikin-dong.pages.dev/
22 Aug 2026 - unknown · https://udah-lama-gak-tampil-digoogle-brand-menara188.pages.dev/
21 Aug 2026 - unknown · https://i.ibb.co/LRSFVmR/Screenshot.png
14 Aug 2026 - malicious · https://buriedchapters.com/
14 Aug 2026 - unknown · https://i.ibb.co/d4vFMPrQ/6368b64a-e9ca-4b2e-9a76-3df6c9f1aa7b-removebg-preview.png
12 Aug 2026 - malicious · https://buriedchapters.com/
12 Aug 2026 - malicious · https://buriedchapters.com/
12 Aug 2026 - malicious · https://buriedchapters.com/

Questions about i.ibb.co

Is i.ibb.co safe?: The scan of i.ibb.co on 22 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with i.ibb.co?: 4 analysed samples communicate with this URL, including Khalesi.
How was i.ibb.co checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of i.ibb.co

Scanned on MalwareAnalyzer by Cyble · Open interactive scan