themeforest.net - suspicious URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned themeforest.net and returned a suspicious verdict (score 28). The page resolved to 172.64.144.180 on Cloudflare, Inc. in US. 31 domains and 1 IP were contacted, over 7 HTTP requests. 6 malware samples communicate with this URL. This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 28) · Confidence 34%
- Scanned URL:
https://themeforest.net/user/designing-world - Domain: themeforest.net · IP: 172.64.144.180 · AS13335 · US
- Server: cloudflare
- Page title: designing-world's profile on ThemeForest
- HTTP status: 200 · text/html; charset=utf-8
- TLS issuer: C=US, O=Google Trust Services, CN=WE1 · valid to Oct 23 07: · subject CN=themeforest.net
- HTTP requests captured: 7
- Scan tier: fast · observed 2026-08-22 07:18:13 UTC
Malware communicating with this URL (6)
These samples were observed contacting or being served from themeforest.net. Each links to its full analysis.
- 582e11f2123922332199be9553d4d4945545efcc1337f94b9f004ba997abf4a9 - referenced ·
582e11f2123922332199be9553d4d494· first seen 2026-08-22 - d32acae3c53811aa5bfbc903b6de504dc40daa3acf0e3d41c5ccba3028e39b73 - referenced ·
d32acae3c53811aa5bfbc903b6de504d· first seen 2026-08-22 - df05cdb875c8c739f4790ded50c1a5a9c6f775bdd704471f725e21582e38c4d3 - referenced ·
df05cdb875c8c739f4790ded50c1a5a9· first seen 2026-08-21 - f5518ed561cffa3ceda01b75a4b7e3686cc5d7b31b4ef7b0f21d1dd495c73b85 - referenced ·
f5518ed561cffa3ceda01b75a4b7e368· first seen 2026-08-15 - 2610d53842857ac09f43a8ab7d32ae4900b4f48bf904247b6b6097c882071c8a - referenced ·
2610d53842857ac09f43a8ab7d32ae49· first seen 2026-08-15 - a087174c61632d342b0cbed9fc2ee6b62823fe99aed7df6bdb5afe352cc123c6 - referenced ·
a087174c61632d342b0cbed9fc2ee6b6· first seen 2026-08-12
Antivirus & YARA (1 of 48 engines)
- YARA: delivr.to detections [yara]: DLV_HTML_Smuggling (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Why this verdict
- Antivirus/YARA detection in page content: DLV_HTML_Smuggling
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Cloudflare
- Joomla
- Google Analytics
Contacted infrastructure
- 172.64.144.180 - AS13335 Cloudflare, Inc. (United States)
Observed indicators
- themeforest.net
- s3.envato.com
- public-assets.envato-static.com
- www.googletagmanager.com
- windows.microsoft.com
- browsehappy.com
- codecanyon.net
- videohive.net
- audiojungle.net
- graphicriver.net
- photodune.net
- 3docean.net
- www.monodesk.com
- elements.envato.com
- author.envato.com
- tutsplus.com
- placeit.net
- community.envato.com
- www.facebook.com
- github.com
Other scans of themeforest.net (9)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - unknown ·
https://lmbri.com/WYSIWYGImage/file/516872162.pdf - 22 Aug 2026 - unknown ·
https://lmbri.com/WYSIWYGImage/file/niwexezigufafutiwagex.pdf - 21 Aug 2026 - suspicious ·
http://iphoneislamicwallpapers.blogspot.com/2012/01/please-subscribe-to-our-mailing-list.html - 20 Aug 2026 - suspicious ·
https://bige.vn/uploads/userfiles/file/judaline.pdf - 20 Aug 2026 - suspicious ·
https://bige.vn/uploads/userfiles/file/judaline.pdf - 20 Aug 2026 - unknown ·
https://topp.pl/_topp/file/wemenavidedofizi.pdf - 20 Aug 2026 - unknown ·
https://topp.pl/_topp/file/wemenavidedofizi.pdf - 19 Aug 2026 - suspicious ·
https://codecanyon.net/licenses - 15 Aug 2026 - unknown ·
https://nkdev.info/
Questions about themeforest.net
- Is themeforest.net safe?
- No. MalwareAnalyzer scanned themeforest.net on 22 Aug 2026 and returned a suspicious verdict with a score of 28 out of 100. Treat it as hostile until it is re-checked.
- What malware is associated with themeforest.net?
- 6 analysed samples communicate with this URL.
- How was themeforest.net checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of themeforest.net
Scanned on MalwareAnalyzer by Cyble · Open interactive scan