logging.cc - URL scan, 20 Aug 2026
MalwareAnalyzer by Cyble scanned logging.cc and returned a unknown verdict (score -12). The page resolved to 172.67.143.59 on Cloudflare, Inc. in US. 5 domains and 1 IP were contacted, over 3 HTTP requests. 14 malware samples communicate with this URL (Delf, Clipbanker, Razy, Urelas). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://logging.cc/ - Domain: logging.cc · IP: 172.67.143.59 · AS13335 · US
- Server: cloudflare
- Page title: Logging
- HTTP status: 200 · text/html; charset=utf-8
- TLS issuer: C=US, O=Google Trust Services, CN=WE1 · valid to Nov 4 06: · subject CN=logging.cc
- HTTP requests captured: 3
- Scan tier: fast · observed 2026-08-20 11:12:18 UTC
Malware communicating with this URL (14)
These samples were observed contacting or being served from logging.cc. Each links to its full analysis.
- Delf - referenced ·
c9c823a6b8edea8e71da61bb13c23177· first seen 2026-08-20 - MicrosoftEdgeUpdateComRegisterShell64.exe - referenced ·
26141f72749fafe473f67bb250b14839· first seen 2026-08-18 - psuser.dll - referenced ·
663753ac5286cdb44990a65c6612768a· first seen 2026-08-18 - Clipbanker - referenced ·
35ec821fadfa8209de2886509ae03a1a· first seen 2026-08-18 - psmachine.dll - referenced ·
244ec7a3a808e9b5206451da5a307c18· first seen 2026-08-18 - psuser.dll - referenced ·
03cc4f4d939170910cd2436d9ac4934a· first seen 2026-08-18 - Clipbanker - referenced ·
7d376d8a64af9562e516dbaabdb392e3· first seen 2026-08-18 - Razy - referenced ·
73e9de9fd143d7dfd2d31b3317bb8120· first seen 2026-08-15 - Urelas - referenced ·
be7ca52ded481cfb3e8c214c656987b6· first seen 2026-08-14 - Razy - referenced ·
1c37563a0376c5dd1546c8aeaf16298b· first seen 2026-08-13 - Lmir - referenced ·
7cd988da89e451ed421ae93e141f4131· first seen 2026-08-12 - HUILoader - referenced ·
5e3493e8ed6953ff60528c730078412a· first seen 2026-08-12 - Fugrafa - referenced ·
06741ad6df147376c98f790965bc7461· first seen 2026-08-12 - Expiro - referenced ·
aea83d771fd248919cfd70311bdc0c16· first seen 2026-08-12
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Cloudflare
- Cloudflare Insights
Contacted infrastructure
- 172.67.143.59 - AS13335 Cloudflare, Inc. (United States)
Observed indicators
- logging.cc
- fonts.gstatic.com
- fonts.googleapis.com
- squidfunk.github.io
- static.cloudflareinsights.com
- 172.67.143.59
- https://logging.cc/
- https://logging.cc/archive/2021/
- https://logging.cc/favicon.svg
- https://logging.cc/assets/stylesheets/main.4b4a2bd9.min.css
- https://logging.cc/assets/stylesheets/palette.356b1318.min.css
- https://fonts.gstatic.com/
- https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback
- https://logging.cc/2021-08-31/istio/
- https://logging.cc/2021-08-31/istio/#_1
- https://logging.cc/2021-08-31/istio/#istio_1
- https://logging.cc/2021-08-31/istio/#_2
- https://logging.cc/2021-08-31/istio/%20%20%20%20%3Cnav%20class=
- https://squidfunk.github.io/mkdocs-material/
- https://logging.cc/assets/javascripts/bundle.81fa17fe.min.js
Other scans of logging.cc (6)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 20 Aug 2026 - unknown
- 18 Aug 2026 - unknown
- 18 Aug 2026 - unknown
- 13 Aug 2026 - unknown
- 12 Aug 2026 - unknown
- 12 Aug 2026 - unknown
Questions about logging.cc
- Is logging.cc safe?
- The scan of logging.cc on 20 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with logging.cc?
- 14 analysed samples communicate with this URL, including Delf, Clipbanker, Razy, Urelas.
- How was logging.cc checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of logging.cc
Scanned on MalwareAnalyzer by Cyble · Open interactive scan