Is doingthing.com safe?

The scan of doingthing.com on 23 Aug 2026 reached no verdict either way (score 6). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with doingthing.com?

3 analysed samples communicate with this URL, including Phishing.

How was doingthing.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

doingthing.com - URL scan, 23 Aug 2026

MalwareAnalyzer by Cyble scanned doingthing.com and returned a unknown verdict (score 6). The page resolved to 47.98.176.118 on Aliyun Computing Co., LTD in CN. The domain was registered 5577 days ago through Alibaba Cloud Computing (Beijing) Co., Ltd.. 6 domains and 1 IP were contacted, over 9 HTTP requests. 3 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 23 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 6) · Confidence 9%
Scanned URL: http://doingthing.com/downloads/blog/geust/files/fuxusuji.pdf
Domain: doingthing.com · IP: 47.98.176.118 · AS37963 · CN
Server: Apache/2.2.22 (Ubuntu)
Page title: 关于我
HTTP status: 200 · text/html
Registrar: Alibaba Cloud Computing (Beijing) Co., Ltd. · domain age 5577 days · created 2011-05-16
HTTP requests captured: 9
Scan tier: standard · observed 2026-08-23 10:00:59 UTC

Malware communicating with this URL (3)

These samples were observed contacting or being served from doingthing.com. Each links to its full analysis.

Phishing - referenced · 112bc884290dfac39b0282c2039bad13 · first seen 2026-08-22
Phishing - referenced · 6a2bc5242e66123ed127fdd38881910b · first seen 2026-08-22
Phishing - referenced · 8c7f2d50b114669d816ccbd917ffb55e · first seen 2026-08-16

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Why this verdict

Served over plaintext HTTP

Detected technologies

Apache
PHP
Google Analytics
jQuery

Contacted infrastructure

47.98.176.118 - AS37963 Aliyun Computing Co., LTD (China)

Observed indicators

doingthing.com
ajax.googleapis.com
github.com
hm.baidu.com
push.zhanzhang.baidu.com
beian.miit.gov.cn
47.98.176.118
http://doingthing.com/downloads/blog/geust/files/fuxusuji.pdf
http://doingthing.com/style/connect.icon
http://doingthing.com/style/date_input.css
http://doingthing.com/style/grouped_to_order_icon.png
http://doingthing.com/js/jquery1.7.1.min.js
http://doingthing.com/logout.php
http://ajax.googleapis.com/ajax/libs/jquery/1.3.1/jquery.min.js
http://github.com/jonleighton/date_input/raw/master/jquery.date_input.js
http://hm.baidu.com/hm.js?c539be3ad53590c0055457966b2b3562
http://hm.baidu.com/hm.js?730fd835c9633b6f92279141f2e4bca8
http://doingthing.com/index.php?login=1
http://doingthing.com/index.php?register=1
http://doingthing.com/downloads/blog/geust/files/js/daojishiajax.js

Questions about doingthing.com

Is doingthing.com safe?: The scan of doingthing.com on 23 Aug 2026 reached no verdict either way (score 6). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with doingthing.com?: 3 analysed samples communicate with this URL, including Phishing.
How was doingthing.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the standard tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of doingthing.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan