satsmate.wordpress.com - suspicious URL scan, 19 Aug 2026

MalwareAnalyzer by Cyble scanned satsmate.wordpress.com and returned a suspicious verdict (score 52), categorised as suspicious-infrastructure, credential-harvest. The page resolved to 192.0.78.12 on Automattic, Inc in US. The domain was registered 9665 days ago through MarkMonitor Inc.. 9 domains and 3 IPs were contacted, over 5 HTTP requests. 1 malware sample communicates with this URL. The request followed 2 redirects before landing. This is a point-in-time observation from 19 Aug 2026; the page may have changed since.

Scan result

• Verdict: suspicious (score 52) · Confidence 61%
• Scanned URL: http://files.forehandfinancial.com/uploads/1/3/1/4/131438111/367ceaa27.pdf
• Domain: satsmate.wordpress.com · IP: 192.0.78.12 · AS2635 · US
• Server: nginx
• Page title: Page not found – SatsMate Podcast
• HTTP status: 404 · text/html; charset=UTF-8
• Registrar: MarkMonitor Inc. · domain age 9665 days · created 2000-03-03
• HTTP requests captured: 5
• Scan tier: fast · observed 2026-08-19 18:00:09 UTC

Redirect chain

1. http://files.forehandfinancial.com/uploads/1/3/1/4/131438111/367ceaa27.pdf
2. http://satsmate.wordpress.com/uploads/1/3/1/4/131438111/367ceaa27.pdf
3. https://satsmate.wordpress.com/uploads/1/3/1/4/131438111/367ceaa27.pdf

Malware communicating with this URL (1)

These samples were observed contacting or being served from satsmate.wordpress.com. Each links to its full analysis.

• 64091661252.pdf - referenced · c180b3728781d5b911bff1c61f7e1399 · first seen 2026-08-19

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Categories

• suspicious-infrastructure
• credential-harvest

Why this verdict

• Credential-harvesting form
• Algorithmically-generated (DGA-like) hostname
• Cross-host redirect chain

Detected technologies

• Nginx
• WordPress
• Google Analytics

Contacted infrastructure

• 192.0.78.12 - AS2635 Automattic, Inc (United States)
• 192.0.78.25 - AS2635 Automattic, Inc (United States)
• 192.0.78.13 - AS2635 Automattic, Inc (United States)

Observed indicators

• satsmate.wordpress.com
• s1.wp.com
• s2.wp.com
• s0.wp.com
• wordpress.com
• satsmate.com
• 0.gravatar.com
• automattic.com
• subscribe.wordpress.com
• 192.0.78.12
• 192.0.78.25
• 192.0.78.13
• https://satsmate.wordpress.com/uploads/1/3/1/4/131438111/367ceaa27.pdf
• https://s1.wp.com/
• https://s2.wp.com/
• https://s0.wp.com/
• https://satsmate.wordpress.com/feed/
• https://satsmate.wordpress.com/comments/feed/
• https://satsmate.wordpress.com/wp-content/mu-plugins/wpcom-theme-compat/blockbase.css?m=1633680961i&cssminify=yes
• https://satsmate.wordpress.com/_static/??/wp-content/mu-plugins/widgets/eu-cookie-law/templates/style.css,/wp-content/blog-plugins/marketing-bar/css/marketing-bar.css?m=1761640963j&cssminify=yes

Other scans of satsmate.wordpress.com (1)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

• 19 Aug 2026 - suspicious

Questions about satsmate.wordpress.com

Is satsmate.wordpress.com safe?

No. MalwareAnalyzer scanned satsmate.wordpress.com on 19 Aug 2026 and returned a suspicious verdict with a score of 52 out of 100, categorised as suspicious-infrastructure and credential-harvest. Treat it as hostile until it is re-checked.

What malware is associated with satsmate.wordpress.com?

1 analysed samples communicate with this URL.

How was satsmate.wordpress.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of satsmate.wordpress.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan