Is ns1.player1352.net safe?

The scan of ns1.player1352.net on 22 Aug 2026 reached no verdict either way (score 1). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with ns1.player1352.net?

7 analysed samples communicate with this URL, including Changeup.

How was ns1.player1352.net checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

ns1.player1352.net - URL scan, 22 Aug 2026

MalwareAnalyzer by Cyble scanned ns1.player1352.net and returned a unknown verdict (score 1), categorised as suspicious-infrastructure. The page resolved to 34.41.139.193 on Google LLC in US. The domain was registered 1624 days ago through Dynadot Inc. 1 domain and 1 IP were contacted. 7 malware samples communicate with this URL (Changeup). This is a point-in-time observation from 22 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 1) · Confidence 7%
Scanned URL: https://ns1.player1352.net/
Domain: ns1.player1352.net · IP: 34.41.139.193 · AS396982 · US
Server: nginx
HTTP status: 200
Registrar: Dynadot Inc · domain age 1624 days · created 2022-03-12
TLS issuer: C=AT, O=ZeroSSL GmbH, CN=ZeroSSL RSA DV SSL CA 2 · valid to Sep 13 23: · subject CN=*.player1352.net
Scan tier: fast · observed 2026-08-22 21:47:10 UTC

Malware communicating with this URL (7)

These samples were observed contacting or being served from ns1.player1352.net. Each links to its full analysis.

f533b12df2a06f952bc1eaa37961ab831ab5de6547714c704094d794306c3a3b - contacted · f533b12df2a06f952bc1eaa37961ab83 · first seen 2026-08-22
1d263fca637e0985a98ffaa98730486d084b4c87e5d616d00fc138433d09cf61 - contacted · 1d263fca637e0985a98ffaa98730486d · first seen 2026-08-22
Changeup - contacted · 83e8613bddb3265c56ffb5db9dcea24d · first seen 2026-08-22
Changeup - contacted · 870e17f96a403c3dcd522d3ca5c2ee8e · first seen 2026-08-22
Changeup - contacted · 40ca47de2be12884ca8129d1c97ce2c4 · first seen 2026-08-21
bd00b5b0b4ff9f6fc6c67ecfd19e3be3115cb0e53c8a45956171fcc2f39ebe3c - contacted · bd00b5b0b4ff9f6fc6c67ecfd19e3be3 · first seen 2026-08-21
Changeup - contacted · 768ad594d749388fc688a3d6c8bcd473 · first seen 2026-08-20

Why this verdict

Algorithmically-generated (DGA-like) hostname
Valid TLS, no impersonation or off-origin credential post

Detected technologies

Nginx

Contacted infrastructure

34.41.139.193 - AS396982 Google LLC (United States)

Observed indicators

ns1.player1352.net
34.41.139.193
https://ns1.player1352.net/

Other scans of ns1.player1352.net (6)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

24 Aug 2026 - unknown
23 Aug 2026 - unknown
22 Aug 2026 - unknown
22 Aug 2026 - unknown
21 Aug 2026 - unknown
21 Aug 2026 - unknown

Questions about ns1.player1352.net

Is ns1.player1352.net safe?: The scan of ns1.player1352.net on 22 Aug 2026 reached no verdict either way (score 1). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with ns1.player1352.net?: 7 analysed samples communicate with this URL, including Changeup.
How was ns1.player1352.net checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of ns1.player1352.net

Scanned on MalwareAnalyzer by Cyble · Open interactive scan