Is ns1.spansearcher.net safe?

The scan of ns1.spansearcher.net on 23 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with ns1.spansearcher.net?

8 analysed samples communicate with this URL, including Changeup.

How was ns1.spansearcher.net checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

ns1.spansearcher.net - URL scan, 23 Aug 2026

MalwareAnalyzer by Cyble scanned ns1.spansearcher.net and returned a unknown verdict (score 0). 1 domain and 0 IPs were contacted. 8 malware samples communicate with this URL (Changeup). This is a point-in-time observation from 23 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 0) · Confidence 3%
Scanned URL: https://ns1.spansearcher.net/
Domain: ns1.spansearcher.net
Scan tier: fast · observed 2026-08-23 09:52:35 UTC

Malware communicating with this URL (8)

These samples were observed contacting or being served from ns1.spansearcher.net. Each links to its full analysis.

Changeup - contacted · 7b2f9631738ece7c43f547961e62f239 · first seen 2026-08-23
f533b12df2a06f952bc1eaa37961ab831ab5de6547714c704094d794306c3a3b - contacted · f533b12df2a06f952bc1eaa37961ab83 · first seen 2026-08-22
1d263fca637e0985a98ffaa98730486d084b4c87e5d616d00fc138433d09cf61 - contacted · 1d263fca637e0985a98ffaa98730486d · first seen 2026-08-22
Changeup - contacted · 83e8613bddb3265c56ffb5db9dcea24d · first seen 2026-08-22
Changeup - contacted · 870e17f96a403c3dcd522d3ca5c2ee8e · first seen 2026-08-22
Changeup - contacted · 40ca47de2be12884ca8129d1c97ce2c4 · first seen 2026-08-21
bd00b5b0b4ff9f6fc6c67ecfd19e3be3115cb0e53c8a45956171fcc2f39ebe3c - contacted · bd00b5b0b4ff9f6fc6c67ecfd19e3be3 · first seen 2026-08-21
Changeup - contacted · 768ad594d749388fc688a3d6c8bcd473 · first seen 2026-08-20

Why this verdict

Target did not respond (DNS/connection failure or timeout); verdict from URL structure only

Observed indicators

ns1.spansearcher.net
https://ns1.spansearcher.net/

Other scans of ns1.spansearcher.net (7)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

24 Aug 2026 - unknown
22 Aug 2026 - unknown
22 Aug 2026 - unknown
22 Aug 2026 - unknown
21 Aug 2026 - unknown
21 Aug 2026 - unknown
20 Aug 2026 - unknown

Questions about ns1.spansearcher.net

Is ns1.spansearcher.net safe?: The scan of ns1.spansearcher.net on 23 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with ns1.spansearcher.net?: 8 analysed samples communicate with this URL, including Changeup.
How was ns1.spansearcher.net checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of ns1.spansearcher.net

Scanned on MalwareAnalyzer by Cyble · Open interactive scan