Is ts.domainname.de safe?

The scan of ts.domainname.de on 21 Aug 2026 reached no verdict either way (score 10). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with ts.domainname.de?

1 analysed samples communicate with this URL, including Phishing.

How was ts.domainname.de checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

ts.domainname.de - URL scan, 21 Aug 2026

MalwareAnalyzer by Cyble scanned ts.domainname.de and returned a unknown verdict (score 10), categorised as credential-harvest. The page resolved to 128.140.116.78 on Hetzner Online GmbH in DE. 3 domains and 2 IPs were contacted, over 3 HTTP requests. 1 malware sample communicates with this URL (Phishing). The request followed 1 redirect before landing. This is a point-in-time observation from 21 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 10) · Confidence 13%
Scanned URL: https://deewo.de/wp-content/plugins/formcraft/file-upload/server/content/files/1615a88efcf76b---terokobizax.pdf
Domain: ts.domainname.de · IP: 128.140.116.78 · AS24940 · DE
Server: nginx/1.27.4
Page title: Der Domainname deewo.de steht zum Verkauf
HTTP status: 200 · text/html; charset=UTF-8
HTTP requests captured: 3
Scan tier: fast · observed 2026-08-21 19:17:00 UTC

Redirect chain

https://deewo.de/wp-content/plugins/formcraft/file-upload/server/content/files/1615a88efcf76b---terokobizax.pdf
https://ts.domainname.de/deewo.de

Malware communicating with this URL (1)

These samples were observed contacting or being served from ts.domainname.de. Each links to its full analysis.

Phishing - referenced · 252d2a35240bab79b4e737abc64734fe · first seen 2026-08-21

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Why this verdict

Credential-harvesting form

Detected technologies

Nginx

Contacted infrastructure

128.140.116.78 - AS24940 Hetzner Online GmbH (Germany)
78.47.106.64 - AS24940 Hetzner Online GmbH (Germany)

Observed indicators

ts.domainname.de
www.enable-javascript.com
www.domainname.de
128.140.116.78
78.47.106.64
https://ts.domainname.de/deewo.de
https://ts.domainname.de/img/favicon.ico
https://ts.domainname.de/css/canberra.css?id=8075cb9dd5978a9f46bf19aff454288d
https://ts.domainname.de/css/negotiation.css?id=44fa639aecd43e1da79f28ea7b392029
https://www.enable-javascript.com/de/
https://ts.domainname.de/cancel
https://ts.domainname.de/continue
https://ts.domainname.de/img/canberra/transfer.png
https://ts.domainname.de/img/canberra/transparent.png
https://ts.domainname.de/img/canberra/transaktionen.png
https://ts.domainname.de/img/canberra/PayPal_Monogram_Full_Color_RGB.png
https://ts.domainname.de/img/canberra/Visa_Brandmark_Blue_RGB_2021.png
https://ts.domainname.de/img/canberra/mc_symbol_opt_73_2x.png
https://ts.domainname.de/img/canberra/Amex_logo_color.png
https://ts.domainname.de/img/canberra/bankueberweisung7.png

Other scans of ts.domainname.de (8)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

22 Aug 2026 - unknown
22 Aug 2026 - unknown · https://ts.domainname.de/lokalesichtbarkeit.de
17 Aug 2026 - unknown
15 Aug 2026 - unknown · https://ts.domainname.de/lokalesichtbarkeit.de
15 Aug 2026 - unknown · https://ts.domainname.de/lokalesichtbarkeit.de
15 Aug 2026 - unknown
14 Aug 2026 - unknown · https://ts.domainname.de/lokalesichtbarkeit.de
13 Aug 2026 - unknown

Questions about ts.domainname.de

Is ts.domainname.de safe?: The scan of ts.domainname.de on 21 Aug 2026 reached no verdict either way (score 10). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with ts.domainname.de?: 1 analysed samples communicate with this URL, including Phishing.
How was ts.domainname.de checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of ts.domainname.de

Scanned on MalwareAnalyzer by Cyble · Open interactive scan