suhrsmad.dk - suspicious URL scan, 23 Aug 2026
MalwareAnalyzer by Cyble scanned suhrsmad.dk and returned a suspicious verdict (score 54). The page resolved to 185.51.79.112 on Network assigned to Valeo Services in DK. 1 domain and 1 IP were contacted. 14 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 23 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 54) · Confidence 60%
- Scanned URL:
https://suhrsmad.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1614885abea844---jixunuwagunuko.pdf - Domain: suhrsmad.dk · IP: 185.51.79.112 · AS205984 · DK
- Server: nginx
- HTTP status: 200 · application/pdf
- Scan tier: fast · observed 2026-08-23 11:46:36 UTC
Malware communicating with this URL (14)
These samples were observed contacting or being served from suhrsmad.dk. Each links to its full analysis.
- Phishing - referenced ·
b476d80cf3777d82fc3c094be9680770· first seen 2026-08-23 - Phishing - referenced ·
5f3c0ec9cba1afef44107d9d728ba557· first seen 2026-08-22 - Phishing - referenced ·
b98609481973dc77d2d2e103dcb7ad73· first seen 2026-08-21 - ddbce9c09d4e7bf77e446fa381d299eded65a194add11ba08dff21041a2bf23b - referenced ·
ddbce9c09d4e7bf77e446fa381d299ed· first seen 2026-08-21 - Phishing - referenced ·
b0ce1bdb8ae96a16f93a22671dc8d17d· first seen 2026-08-21 - Phishing - referenced ·
b65630c09c75c1c9044649c7f24a574c· first seen 2026-08-19 - Phishing - referenced ·
453023f03d41c4b9e07e9fcc99319ce9· first seen 2026-08-17 - Phishing - referenced ·
68df6f0777fa4d9aca150123344fc268· first seen 2026-08-16 - Phishing - referenced ·
905207413babd9204ae15530482d1858· first seen 2026-08-16 - Phishing - referenced ·
d6c6c6db8f7cf4a0783af2e602a79d09· first seen 2026-08-15 - Phishing - referenced ·
ffffab4cb3c899077921d651c8c8df40· first seen 2026-08-15 - Phishing - referenced ·
d918d6136c107756b05823410c234d70· first seen 2026-08-15 - Phishing - referenced ·
2921e764a3477160ceb5e913c79d653e· first seen 2026-08-15 - Phishing - referenced ·
13abe4d2ccf517b1edd9829e2a149c8d· first seen 2026-08-14
Antivirus & YARA (1 of 48 engines)
- ClamAV (daily) [av]: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (served file)
Why this verdict
- Antivirus/YARA detection in page content: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
- File download routed to the malware sandbox (1614885abea844---jixunuwagunuko.pdf)
Detected technologies
- Nginx
Contacted infrastructure
- 185.51.79.112 - AS205984 Network assigned to Valeo Services (Denmark)
Files served by this page
- 1614885abea844---jixunuwagunuko.pdf ·
404bddf943b7035627031c3ff608acc1
Observed indicators
- suhrsmad.dk
- 185.51.79.112
- https://suhrsmad.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1614885abea844---jixunuwagunuko.pdf
Other scans of suhrsmad.dk (1)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 15 Aug 2026 - suspicious ·
https://suhrsmad.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160713e489a01d---w
Questions about suhrsmad.dk
- Is suhrsmad.dk safe?
- No. MalwareAnalyzer scanned suhrsmad.dk on 23 Aug 2026 and returned a suspicious verdict with a score of 54 out of 100. Treat it as hostile until it is re-checked.
- What malware is associated with suhrsmad.dk?
- 14 analysed samples communicate with this URL, including Phishing.
- How was suhrsmad.dk checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of suhrsmad.dk
Scanned on MalwareAnalyzer by Cyble · Open interactive scan