pastebin.com - URL scan, 23 Aug 2026
MalwareAnalyzer by Cyble scanned pastebin.com and returned a unknown verdict (score -7). The page resolved to 172.66.171.73 on Cloudflare, Inc. in US. 1 domain and 2 IPs were contacted. 8 malware samples communicate with this URL (Maldoc, HUILoader, Khalesi, Emotet). The request followed 1 redirect before landing. This is a point-in-time observation from 23 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -7) · Confidence 13%
- Scanned URL:
http://pastebin.com/download.php?i=DDD0rAXN - Domain: pastebin.com · IP: 172.66.171.73 · AS13335 · US
- Server: cloudflare
- Page title: 404 Not Found
- HTTP status: 404 · text/html; charset=utf-8
- TLS issuer: C=US, O=Google Trust Services, CN=WE1 · valid to Oct 11 21: · subject CN=pastebin.com
- Scan tier: fast · observed 2026-08-23 13:07:44 UTC
Redirect chain
http://pastebin.com/download.php?i=DDD0rAXNhttps://pastebin.com/download.php?i=DDD0rAXN
Malware communicating with this URL (8)
These samples were observed contacting or being served from pastebin.com. Each links to its full analysis.
- Maldoc - c2 ·
5f1881a98712a536b3b9348ec351567c· first seen 2026-08-23 - 1cac1f352efdb0c1d638cd32f7e3de5ed85273c60b54384c586b537638771730 - c2 ·
1cac1f352efdb0c1d638cd32f7e3de5e· first seen 2026-08-23 - 321469e48e5e7fe6b36149db3062896b3e07190d29d86c7059e0c932ada2bfa1 - c2 ·
321469e48e5e7fe6b36149db3062896b· first seen 2026-08-22 - 250f99e646bdfeae1f8832b7bc77a5e0092e5a0f8fd435fe17cbbf88e248cd84 - c2 ·
250f99e646bdfeae1f8832b7bc77a5e0· first seen 2026-08-22 - HUILoader - contacted ·
b9e60e01b90bed802bf6bad8ed72cbac· first seen 2026-08-22 - Khalesi - referenced ·
035a6fa4064026934d0a631c9c1f1b9a· first seen 2026-08-21 - Emotet - c2 ·
64340a095707345c63b0f8e6faa080ee· first seen 2026-08-20 - Persistence - referenced ·
effcf8b51b8ee0e1e70e78aa4d77c544· first seen 2026-08-18
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
- Hosted on abuse-prone infrastructure (paste-site)
Detected technologies
- Cloudflare
Contacted infrastructure
- 172.66.171.73 - AS13335 Cloudflare, Inc. (United States)
- 104.20.29.150 - AS13335 Cloudflare, Inc. (United States)
Observed indicators
- pastebin.com
- 172.66.171.73
- 104.20.29.150
- https://pastebin.com/download.php?i=DDD0rAXN
Other scans of pastebin.com (7)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown ·
https://pastebin.com/ - 22 Aug 2026 - unknown ·
https://pastebin.com/ - 22 Aug 2026 - unknown ·
https://pastebin.com/ - 21 Aug 2026 - unknown ·
https://pastebin.com/raw/nvPqZVcV - 21 Aug 2026 - unknown ·
https://pastebin.com/raw/hkytwPyt - 20 Aug 2026 - unknown ·
https://pastebin.com/ - 30 Jul 2026 - unknown ·
https://pastebin.com/p9Dkzfpq
Questions about pastebin.com
- Is pastebin.com safe?
- The scan of pastebin.com on 23 Aug 2026 reached no verdict either way (score -7). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with pastebin.com?
- 8 analysed samples communicate with this URL, including Maldoc, HUILoader, Khalesi, Emotet.
- How was pastebin.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of pastebin.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan