gmpg.org - URL scan, 23 Aug 2026
MalwareAnalyzer by Cyble scanned gmpg.org and returned a unknown verdict (score 6). The page resolved to 66.155.40.24 on Aptum Technologies in US. 6 domains and 1 IP were contacted. 74 malware samples communicate with this URL (Coinminer, Obfus, Fromcharcode). This is a point-in-time observation from 23 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 6) · Confidence 9%
- Scanned URL:
http://gmpg.org/xfn/11 - Domain: gmpg.org · IP: 66.155.40.24 · AS13768 · US
- Server: nginx
- Page title: XFN 1.1 profile
- HTTP status: 200 · text/html; charset=UTF-8
- Scan tier: fast · observed 2026-08-23 11:57:26 UTC
Malware communicating with this URL (74)
These samples were observed contacting or being served from gmpg.org. Each links to its full analysis.
- 5bcebd872926795f7903c550337ab862e9d3c6eb853752eeb27ae254682e9058 - referenced ·
5bcebd872926795f7903c550337ab862· first seen 2026-08-23 - a49a43eba9a66721d43f5cfa040d356cadd8f10f831bef2a0239a1e702300c83 - referenced ·
a49a43eba9a66721d43f5cfa040d356c· first seen 2026-08-23 - 2256ae2c24407a612470e365be27bfc5987744663f7000e72f7d4b82154c5ab2 - referenced ·
2256ae2c24407a612470e365be27bfc5· first seen 2026-08-22 - 225c87cb8dfea59859488079883a7bc9bf94b26ba737df3c6a17a06b848b2e5e - referenced ·
225c87cb8dfea59859488079883a7bc9· first seen 2026-08-22 - 2253bb18a405d20b7193273abbd2aa12c81bb8324bb2de3d8106a541f00e846c - referenced ·
2253bb18a405d20b7193273abbd2aa12· first seen 2026-08-22 - Coinminer - referenced ·
225b2f97a53020c31f8986282383848c· first seen 2026-08-22 - Obfus - referenced ·
225022ef7b21707d7c89a1efbe913e49· first seen 2026-08-22 - 417544f43480cc43a3f51b140dea79f7036424b1feb1f33cea45733458b23bb6 - referenced ·
417544f43480cc43a3f51b140dea79f7· first seen 2026-08-22 - d32170aa3bee128f9c787f52ba15094ee5f3041d37eb30d1fede2a7995ccb98c - referenced ·
d32170aa3bee128f9c787f52ba15094e· first seen 2026-08-22 - 83355f36ca7d09d458a272889ea6e99e337cc5a224e8a5eb4b6b87c51d83efd8 - referenced ·
83355f36ca7d09d458a272889ea6e99e· first seen 2026-08-22 - d32f5c6e11ed7d02464bb91e60eb2134d7ce73cd440f2abbb54b9461bce98f0e - referenced ·
d32f5c6e11ed7d02464bb91e60eb2134· first seen 2026-08-22 - Fromcharcode - referenced ·
d32d2fc8713f7ae3123942de89aed781· first seen 2026-08-22 - e11c830ee7d49fc2f8988915806b9bd6d474938fa5a63429424ceac0f4352ce6 - referenced ·
e11c830ee7d49fc2f8988915806b9bd6· first seen 2026-08-22 - 52a7c21bc58ba4f46514eda5d7e9a28d97ba4b9c5909f155f3010202fc1ec0e2 - referenced ·
52a7c21bc58ba4f46514eda5d7e9a28d· first seen 2026-08-22 - d321baaed8bc0a74638123dd0e28d21f28eb2915843602c8fe8f78967f352c69 - referenced ·
d321baaed8bc0a74638123dd0e28d21f· first seen 2026-08-22
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Served over plaintext HTTP
Detected technologies
- Nginx
Contacted infrastructure
- 66.155.40.24 - AS13768 Aptum Technologies (United States)
Observed indicators
- gmpg.org
- tantek.com
- photomatt.net
- meyerweb.com
- www.w3.org
- creativecommons.org
- 66.155.40.24
- http://gmpg.org/xfn/11
- http://gmpg.org/xfn/default.css
- http://gmpg.org/xfn/
- http://gmpg.org/xfn/intro
- http://gmpg.org/xfn/faq
- http://tantek.com/
- http://photomatt.net/
- http://meyerweb.com/
- http://www.w3.org/TR/html401/struct/global.html#h-7.4.4.3
- http://www.w3.org/TR/html401/struct/links.html#adef-rel
- http://gmpg.org/xfn/thanks
- http://creativecommons.org/licenses/by-nd/2.0/
Other scans of gmpg.org (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - suspicious ·
https://goactive.hu/wp-content/plugins/super-forms/uploads/php/files/a60475b369c455be45ab061ab56a96a - 24 Aug 2026 - unknown ·
https://smarttactic.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1607bfca797ce2- - 24 Aug 2026 - unknown ·
https://main.mdsalon.ru/ - 24 Aug 2026 - unknown ·
https://alompar.hu/uploads/content_files/files/41377062345.pdf - 24 Aug 2026 - unknown ·
https://alompar.hu/uploads/content_files/files/41377062345.pdf - 24 Aug 2026 - unknown ·
https://www.alexoloughlinonline.com/author/admin/ - 24 Aug 2026 - unknown ·
https://www.alexoloughlinonline.com/hawaii-five-0-pilot-clip/ - 24 Aug 2026 - unknown ·
https://www.alexoloughlinonline.com/ - 24 Aug 2026 - unknown ·
https://www.diktu.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609a30ebd8ce6-- - 24 Aug 2026 - unknown ·
https://daluxerealty.com/wp-content/plugins/super-forms/uploads/php/files/8pvabit6uk053b5cjqv5e7m3u2
Questions about gmpg.org
- Is gmpg.org safe?
- The scan of gmpg.org on 23 Aug 2026 reached no verdict either way (score 6). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with gmpg.org?
- 74 analysed samples communicate with this URL, including Coinminer, Obfus, Fromcharcode.
- How was gmpg.org checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of gmpg.org
Scanned on MalwareAnalyzer by Cyble · Open interactive scan