pastebin.com - URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned pastebin.com and returned a unknown verdict (score 3), categorised as credential-harvest. The page resolved to 104.20.29.150 on Cloudflare, Inc. in US. The domain was registered 8753 days ago through NameCheap, Inc.. 6 domains and 1 IP were contacted, over 14 HTTP requests. 4 malware samples communicate with this URL (HUILoader, Khalesi, Emotet, Persistence). This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 3) · Confidence 12%
- Scanned URL:
https://pastebin.com/ - Domain: pastebin.com · IP: 104.20.29.150 · AS13335 · US
- Server: cloudflare
- Page title: Pastebin.com - #1 paste tool since 2002!
- HTTP status: 200 · text/html; charset=UTF-8
- Registrar: NameCheap, Inc. · domain age 8753 days · created 2002-09-03
- TLS issuer: C=US, O=Google Trust Services, CN=WE1 · valid to Oct 11 21: · subject CN=pastebin.com
- HTTP requests captured: 14
- Scan tier: fast · observed 2026-08-22 01:56:07 UTC
Malware communicating with this URL (4)
These samples were observed contacting or being served from pastebin.com. Each links to its full analysis.
- HUILoader - contacted ·
b9e60e01b90bed802bf6bad8ed72cbac· first seen 2026-08-22 - Khalesi - referenced ·
035a6fa4064026934d0a631c9c1f1b9a· first seen 2026-08-21 - Emotet - c2 ·
64340a095707345c63b0f8e6faa080ee· first seen 2026-08-20 - Persistence - referenced ·
effcf8b51b8ee0e1e70e78aa4d77c544· first seen 2026-08-18
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Categories
- credential-harvest
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
- Credential-harvesting form
- Hosted on abuse-prone infrastructure (paste-site)
Detected technologies
- Cloudflare
- Google Analytics
- jQuery
- Bootstrap
Contacted infrastructure
- 104.20.29.150 - AS13335 Cloudflare, Inc. (United States)
Observed indicators
- pastebin.com
- www.googletagmanager.com
- cdnjs.cloudflare.com
- services.vlitag.com
- facebook.com
- twitter.com
- 104.20.29.150
- https://pastebin.com/
- https://www.googletagmanager.com/gtag/js?id=G-S72LBY47R8
- https://pastebin.com/favicon.ico
- https://pastebin.com/assets/c80611c4/css/bootstrap.min.css
- https://pastebin.com/assets/ff2ff0b/css/select2.min.css
- https://pastebin.com/assets/c19c6973/css/select2-addl.min.css
- https://pastebin.com/assets/c19c6973/css/select2-default.min.css
- https://pastebin.com/assets/fb16b45a/css/kv-widgets.min.css
- https://pastebin.com/assets/d65ff796/dist/bootstrap-tagsinput.css
- https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.58.2/codemirror.min.css
- https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.58.2/theme/material-darker.min.css
- https://pastebin.com/themes/pastebin/css/vendors.bundle.css?30d6ece6979ee0cf5531
- https://pastebin.com/themes/pastebin/css/app.bundle.css?30d6ece6979ee0cf5531
Other scans of pastebin.com (7)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown ·
https://pastebin.com/download.php?i=DDD0rAXN - 23 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 21 Aug 2026 - unknown ·
https://pastebin.com/raw/nvPqZVcV - 21 Aug 2026 - unknown ·
https://pastebin.com/raw/hkytwPyt - 20 Aug 2026 - unknown
- 30 Jul 2026 - unknown ·
https://pastebin.com/p9Dkzfpq
Questions about pastebin.com
- Is pastebin.com safe?
- The scan of pastebin.com on 22 Aug 2026 reached no verdict either way (score 3). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with pastebin.com?
- 4 analysed samples communicate with this URL, including HUILoader, Khalesi, Emotet, Persistence.
- How was pastebin.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of pastebin.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan