Is oawebserver.com safe?

No. MalwareAnalyzer scanned oawebserver.com on 20 Aug 2026 and returned a suspicious verdict with a score of 24 out of 100, categorised as credential-harvest. Treat it as hostile until it is re-checked.

What malware is associated with oawebserver.com?

3 analysed samples communicate with this URL, including Phishing.

How was oawebserver.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

oawebserver.com - suspicious URL scan, 20 Aug 2026

MalwareAnalyzer by Cyble scanned oawebserver.com and returned a suspicious verdict (score 24), categorised as credential-harvest. The page resolved to 104.21.7.240 on Cloudflare, Inc. in US. The domain was registered 9012 days ago through OnlineNIC, Inc.. 8 domains and 1 IP were contacted, over 3 HTTP requests. 3 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.

Scan result

Verdict: suspicious (score 24) · Confidence 30%
Scanned URL: http://oawebserver.com/piceditor/file/44490140813.pdf
Domain: oawebserver.com · IP: 104.21.7.240 · AS13335 · US
Server: cloudflare
Page title: Untitled Document
HTTP status: 200 · text/html; charset=UTF-8
Registrar: OnlineNIC, Inc. · domain age 9012 days · created 2001-12-17
HTTP requests captured: 3
Scan tier: fast · observed 2026-08-20 23:06:22 UTC

Malware communicating with this URL (3)

These samples were observed contacting or being served from oawebserver.com. Each links to its full analysis.

Phishing - referenced · 70236f43de4c1fff567250224a2e1e8a · first seen 2026-08-14
Phishing - referenced · a64ff70ec25264c8d0a50f49a3027287 · first seen 2026-08-13
Phishing - referenced · bf7a187bd027a86f4948d301c1876da4 · first seen 2026-08-13

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Why this verdict

Credential-harvesting form
Served over plaintext HTTP

Detected technologies

Cloudflare
Cloudflare Insights

Contacted infrastructure

104.21.7.240 - AS13335 Cloudflare, Inc. (United States)

Observed indicators

oawebserver.com
static.cloudflareinsights.com
fonts.googleapis.com
fonts.gstatic.com
cdnjs.cloudflare.com
challenges.cloudflare.com
www.facebook.com
www.oaweb.com
104.21.7.240
http://oawebserver.com/piceditor/file/44490140813.pdf
https://static.cloudflareinsights.com/beacon.min.js/v4513226cdae34746b4dedf0b4dfa099e1781791509496
https://fonts.googleapis.com/
https://fonts.gstatic.com/
https://fonts.googleapis.com/css2?family=Sarabun:wght@300;400;500;600&family=Raleway:wght@700;800&display=swap
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css
https://challenges.cloudflare.com/turnstile/v0/api.js
http://oawebserver.com/piceditor/file/index.php
http://oawebserver.com/piceditor/file/images/logo.png
http://oawebserver.com/piceditor/file/index.php?lng=1
http://oawebserver.com/piceditor/file/images/th.png

Other scans of oawebserver.com (7)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

21 Aug 2026 - suspicious · http://oawebserver.com/piceditor/file/82037909224.pdf
21 Aug 2026 - suspicious · http://oawebserver.com/piceditor/file/82037909224.pdf
20 Aug 2026 - suspicious
13 Aug 2026 - suspicious · http://oawebserver.com/piceditor/file/baxalot.pdf
13 Aug 2026 - suspicious · http://oawebserver.com/piceditor/file/baxalot.pdf
13 Aug 2026 - suspicious · http://oawebserver.com/piceditor/file/nerikapen.pdf
13 Aug 2026 - suspicious · http://oawebserver.com/piceditor/file/nerikapen.pdf

Questions about oawebserver.com

Is oawebserver.com safe?: No. MalwareAnalyzer scanned oawebserver.com on 20 Aug 2026 and returned a suspicious verdict with a score of 24 out of 100, categorised as credential-harvest. Treat it as hostile until it is re-checked.
What malware is associated with oawebserver.com?: 3 analysed samples communicate with this URL, including Phishing.
How was oawebserver.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of oawebserver.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan