johnknox.ch - URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned johnknox.ch and returned a unknown verdict (score 18). The page resolved to 83.166.138.10 on Infomaniak Network SA in CH. 7 domains and 1 IP were contacted, over 54 HTTP requests. 1 malware sample communicates with this URL (Phishing). The request followed 1 redirect before landing. This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 18) · Confidence 24%
- Scanned URL:
http://www.johnknox.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1608a1189c1f69---dikor.pdf - Domain: johnknox.ch · IP: 83.166.138.10 · AS29222 · CH
- Server: Apache
- Page title: Page non trouvée – Centre International John Knox
- HTTP status: 404 · text/html; charset=UTF-8
- HTTP requests captured: 54
- Scan tier: fast · observed 2026-08-22 04:52:00 UTC
Redirect chain
http://www.johnknox.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1608a1189c1f69---dikor.pdfhttp://johnknox.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1608a1189c1f69---dikor.pdf
Malware communicating with this URL (1)
These samples were observed contacting or being served from johnknox.ch. Each links to its full analysis.
- Phishing - referenced ·
2787242f42b006880cf4da0a9917a7d9· first seen 2026-08-22
Antivirus & YARA (1 of 48 engines)
- YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Why this verdict
- A signature matched text in the page (DLV_HTML_Smuggling) — pages that discuss malware can match, so this alone is not a malicious verdict
- Served over plaintext HTTP
Detected technologies
- Apache
- WordPress
- jQuery
Contacted infrastructure
- 83.166.138.10 - AS29222 Infomaniak Network SA (Switzerland)
Observed indicators
- johnknox.ch
- maps.googleapis.com
- meet.jit.si
- fonts.googleapis.com
- www.temoignerensembleageneve.org
- g.page
- www.google.com
- 83.166.138.10
- http://johnknox.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1608a1189c1f69---dikor.pdf
- http://maps.googleapis.com/
- http://meet.jit.si/
- http://fonts.googleapis.com/
- https://johnknox.ch/feed/
- https://johnknox.ch/comments/feed/
- http://johnknox.ch/wp-includes/css/dist/block-library/style.min.css?ver=7.1
- http://johnknox.ch/wp-content/plugins/weglot/dist/css/front-css.css?ver=6.2
- http://johnknox.ch/wp-content/plugins/weglot/dist/css/new-flags.css?ver=6.2
- http://johnknox.ch/wp-content/themes/twentytwelve/fonts/font-open-sans.css?ver=20230328
- http://johnknox.ch/wp-content/themes/twentytwelve/style.css?ver=20260520
- http://johnknox.ch/wp-content/themes/twentytwelve/css/blocks.css?ver=20251031
Questions about johnknox.ch
- Is johnknox.ch safe?
- The scan of johnknox.ch on 22 Aug 2026 reached no verdict either way (score 18). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with johnknox.ch?
- 1 analysed samples communicate with this URL, including Phishing.
- How was johnknox.ch checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of johnknox.ch
Scanned on MalwareAnalyzer by Cyble · Open interactive scan