sigmabhp.pl - URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned sigmabhp.pl and returned a unknown verdict (score 12). The page resolved to 85.128.197.12 on webhosting servers in PL. The domain was registered 5204 days ago through nazwa.pl sp. z o.o.. 4 domains and 1 IP were contacted, over 13 HTTP requests. 3 malware samples communicate with this URL (Phishing). The request followed 1 redirect before landing. This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 12) · Confidence 15%
- Scanned URL:
http://sigmabhp.pl/userfiles/file/fekuvosopiwugax.pdf - Domain: sigmabhp.pl · IP: 85.128.197.12 · AS15967 · PL
- Server: Apache/2
- Page title: Strona nie została znaleziona – Sigma BHP
- HTTP status: 404 · text/html; charset=UTF-8
- Registrar: nazwa.pl sp. z o.o. · domain age 5204 days · created 2012-05-23
- Registrant country: pl
- Evidenced operator: Sitepark Grzegorz Węzigowski
- HTTP requests captured: 13
- Scan tier: fast · observed 2026-08-22 11:21:55 UTC
Redirect chain
http://sigmabhp.pl/userfiles/file/fekuvosopiwugax.pdfhttps://sigmabhp.pl/userfiles/file/fekuvosopiwugax.pdf
Malware communicating with this URL (3)
These samples were observed contacting or being served from sigmabhp.pl. Each links to its full analysis.
- Phishing - referenced ·
ff1ae0f8bac3777932d971cb86892901· first seen 2026-08-22 - Phishing - referenced ·
11db2a44ee089a1c96b997f0e795deca· first seen 2026-08-14 - Phishing - referenced ·
fa86ff43b8cd8e1b89d9fcae49394984· first seen 2026-08-14
Antivirus & YARA (1 of 48 engines)
- YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Why this verdict
- A signature matched text in the page (DLV_HTML_Smuggling) — pages that discuss malware can match, so this alone is not a malicious verdict
Detected technologies
- Apache
- WordPress
- jQuery
Contacted infrastructure
- 85.128.197.12 - AS15967 webhosting servers (Poland)
Observed indicators
- sigmabhp.pl
- gmpg.org
- fonts.googleapis.com
- www.famethemes.com
- 85.128.197.12
- https://sigmabhp.pl/userfiles/file/fekuvosopiwugax.pdf
- https://gmpg.org/xfn/11
- https://fonts.googleapis.com/
- https://sigmabhp.pl/feed/
- https://sigmabhp.pl/comments/feed/
- https://fonts.googleapis.com/css?family=Raleway%3A400%2C500%2C600%2C700%2C300%2C100%2C800%2C900%7COpen+Sans%3A400%2C300%2C300italic%2C400italic%2C600%2C600italic%2C700%2C700italic&subset=latin%2Clatin-ext&display=swap&ver=2.3.21
- https://sigmabhp.pl/wp-content/themes/onepress/assets/frontend/lightgallery.css?ver=bf7c61378f839a6c2348
- https://sigmabhp.pl/wp-content/themes/onepress/assets/frontend/theme.css?ver=b7efae94b44455f36531
- https://sigmabhp.pl/wp-content/plugins/wp-letsencrypt-ssl/admin/js/jsredirect.js?ver=7.8.7.3
- https://sigmabhp.pl/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
- https://sigmabhp.pl/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
- https://sigmabhp.pl/wp-json/
- https://sigmabhp.pl/xmlrpc.php?rsd
- https://sigmabhp.pl/wp-content/uploads/2024/02/cropped-baner-32x32.jpg
- https://sigmabhp.pl/wp-content/uploads/2024/02/cropped-baner-192x192.jpg
Other scans of sigmabhp.pl (4)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 22 Aug 2026 - unknown
- 14 Aug 2026 - unknown ·
https://sigmabhp.pl/userfiles/file/71287646536.pdf - 14 Aug 2026 - unknown ·
https://sigmabhp.pl/userfiles/file/dafugapanimij.pdf - 14 Aug 2026 - unknown ·
https://sigmabhp.pl/userfiles/file/dafugapanimij.pdf
Questions about sigmabhp.pl
- Is sigmabhp.pl safe?
- The scan of sigmabhp.pl on 22 Aug 2026 reached no verdict either way (score 12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with sigmabhp.pl?
- 3 analysed samples communicate with this URL, including Phishing.
- How was sigmabhp.pl checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of sigmabhp.pl
Scanned on MalwareAnalyzer by Cyble · Open interactive scan