Is javascript.nwbox.com safe?

The scan of javascript.nwbox.com on 15 Aug 2026 reached no verdict either way (score 6). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with javascript.nwbox.com?

1 analysed samples communicate with this URL, including Gootloader.

How was javascript.nwbox.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

javascript.nwbox.com - URL scan, 15 Aug 2026

MalwareAnalyzer by Cyble scanned javascript.nwbox.com and returned a unknown verdict (score 6). The page resolved to 79.125.21.126 on Amazon Data Services Ireland Ltd in IE. The domain was registered 9949 days ago through Register SPA. 7 domains and 1 IP were contacted, over 2 HTTP requests. 1 malware sample communicates with this URL (Gootloader). This is a point-in-time observation from 15 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 6) · Confidence 9%
Scanned URL: http://javascript.nwbox.com/IEContentLoaded/
Domain: javascript.nwbox.com · IP: 79.125.21.126 · AS16509 · IE
Server: Apache
Page title: IEContentLoaded - An alternative for DOMContenloaded on Internet Explorer
HTTP status: 200 · text/html; charset=utf-8
Registrar: Register SPA · domain age 9949 days · created 1999-05-20
HTTP requests captured: 2
Scan tier: fast · observed 2026-08-15 15:00:30 UTC

Malware communicating with this URL (1)

These samples were observed contacting or being served from javascript.nwbox.com. Each links to its full analysis.

Gootloader - referenced · 7c83cf241d34c75c75aa1d81bf333aac · first seen 2026-08-15

Antivirus & YARA (0 of 44 engines)

No engine flagged this page's content.

Why this verdict

Served over plaintext HTTP

Detected technologies

Apache
Google Analytics

Contacted infrastructure

79.125.21.126 - AS16509 Amazon Data Services Ireland Ltd (Ireland)

Observed indicators

javascript.nwbox.com
msdn2.microsoft.com
dean.edwards.name
www.cherny.com
www.thefutureoftheweb.com
tanny.ica.com
www.google-analytics.com
79.125.21.126
http://javascript.nwbox.com/IEContentLoaded/
http://javascript.nwbox.com/IEContentLoaded/iecontentloaded.js
http://msdn2.microsoft.com/en-us/library/ms531024.aspx
http://dean.edwards.name/weblog/2005/09/busted2/
http://msdn2.microsoft.com/en-us/library/ms531426.aspx
http://javascript.nwbox.com/IEContentLoaded/iecontentloaded.html
http://javascript.nwbox.com/IEContentLoaded/iecontentloaded.php
http://javascript.nwbox.com/IEContentLoaded/iecontentloaded_i.html
http://javascript.nwbox.com/IEContentLoaded/iecontentloaded_i.php
http://dean.edwards.name/weblog/2006/06/again/
http://www.cherny.com/webdev/26/domloaded-object-literal-updated
http://www.thefutureoftheweb.com/blog/adddomloadevent

Other scans of javascript.nwbox.com (2)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

22 Aug 2026 - unknown
15 Aug 2026 - unknown · https://github.com/jquery/sizzle/wiki

Questions about javascript.nwbox.com

Is javascript.nwbox.com safe?: The scan of javascript.nwbox.com on 15 Aug 2026 reached no verdict either way (score 6). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with javascript.nwbox.com?: 1 analysed samples communicate with this URL, including Gootloader.
How was javascript.nwbox.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of javascript.nwbox.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan