The scan of renewone.de on 20 Aug 2026 reached no verdict either way (score 10). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with renewone.de?

4 analysed samples communicate with this URL, including Phishing.

How was renewone.de checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

renewone.de - URL scan, 20 Aug 2026

MalwareAnalyzer by Cyble scanned renewone.de and returned a unknown verdict (score 10), categorised as credential-harvest. The page resolved to 136.243.123.163 on Hetzner Online GmbH in DE. 12 domains and 1 IP were contacted, over 19 HTTP requests. 4 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 20 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 10) · Confidence 13%
Scanned URL: https://renewone.de/files/gitulenevimiratuwojip.pdf
Domain: renewone.de · IP: 136.243.123.163 · AS24940 · DE
Server: Apache
Page title: Renewone
HTTP status: 404 · text/html; charset=UTF-8
HTTP requests captured: 19
Scan tier: fast · observed 2026-08-20 08:06:40 UTC

Malware communicating with this URL (4)

These samples were observed contacting or being served from renewone.de. Each links to its full analysis.

Phishing - referenced · 845952c288ec08ef3aecab31364266c6 · first seen 2026-08-20
Phishing - referenced · 6133884a9734dbf07402ce85452a1fd6 · first seen 2026-08-15
Phishing - referenced · a3d1fbd2f755ca671b396bfd7134c3cd · first seen 2026-08-13
Phishing - referenced · 32f9e5078ac5a73f0f5900a9211e3ebe · first seen 2026-08-12

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Why this verdict

Credential-harvesting form

Detected technologies

Apache
Google Analytics
jQuery

Contacted infrastructure

136.243.123.163 - AS24940 Hetzner Online GmbH (Germany)

Observed indicators

renewone.de
eu1-config.doofinder.com
web.cmp.usercentrics.eu
www.google.com
policies.google.com
retoure.renewone.de
ticket.renewone.de
www.facebook.com
www.instagram.com
www.youtube.com
www.linkedin.com
code.jquery.com
136.243.123.163
https://renewone.de/files/gitulenevimiratuwojip.pdf
https://renewone.de/bundles/doofinder/css/doofinder.css?1783620585
https://eu1-config.doofinder.com/2.x/52759f1c-1820-4882-ad6f-7fc422409553.js
https://renewone.de/media/28/60/b7/1775054798/renewone-new-logo-s.png?ts=1775054798
https://renewone.de/theme/663e05dcb8af75a7e783f87436f783c0/css/all.css?1784707105
https://web.cmp.usercentrics.eu/modules/autoblocker.js
https://web.cmp.usercentrics.eu/ui/loader.js

Other scans of renewone.de (2)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

22 Aug 2026 - unknown · https://renewone.de/files/rutezu.pdf
20 Aug 2026 - unknown · https://renewone.de/files/92148121447.pdf

Questions about renewone.de

Is renewone.de safe?: The scan of renewone.de on 20 Aug 2026 reached no verdict either way (score 10). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with renewone.de?: 4 analysed samples communicate with this URL, including Phishing.
How was renewone.de checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of renewone.de

Scanned on MalwareAnalyzer by Cyble · Open interactive scan