webmodels.studio - suspicious URL scan, 19 Aug 2026
MalwareAnalyzer by Cyble scanned webmodels.studio and returned a suspicious verdict (score 28). The page resolved to 78.140.140.250 on Webzilla B.V. in NL. 7 domains and 1 IP were contacted, over 7 HTTP requests. 20 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 19 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 28) · Confidence 34%
- Scanned URL:
https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/160bbd8056bd84---batubaderewopusidex.pdf - Domain: webmodels.studio · IP: 78.140.140.250 · AS35415 · NL
- Page title: Ничего не найдено для % request_words%
- HTTP status: 404 · text/html; charset=UTF-8
- TLS issuer: C=US, O=Let's Encrypt, CN=YR2 · valid to Oct 25 13: · subject CN=*.lux.cam
- HTTP requests captured: 7
- Scan tier: fast · observed 2026-08-19 18:05:42 UTC
Malware communicating with this URL (20)
These samples were observed contacting or being served from webmodels.studio. Each links to its full analysis.
- Phishing - referenced ·
405685975d3db3e1d852f27106578adb· first seen 2026-08-19 - Phishing - referenced ·
cf1239b3788587505fa8e04eb2601aa0· first seen 2026-08-19 - Phishing - referenced ·
82b31f48475ac6071af7b836af355fae· first seen 2026-08-17 - Phishing - referenced ·
27767b43266e09595ad9043e0ae60cb4· first seen 2026-08-17 - Phishing - referenced ·
5cc78e1bf8735859def97a7963f66f6b· first seen 2026-08-17 - Phishing - referenced ·
b259d113ff047ddb0b527631aa0dbdf4· first seen 2026-08-16 - Phishing - referenced ·
f877987514d8812a5a733a28823b679b· first seen 2026-08-16 - Phishing - referenced ·
c76cfe8598c8532ba2724a88ab1e9ad1· first seen 2026-08-15 - Phishing - referenced ·
87009dbde4e4326105714e7ab7860a79· first seen 2026-08-15 - Phishing - referenced ·
0cbe3808276b2e80bcba2cd20e937a72· first seen 2026-08-15 - Phishing - referenced ·
5731c5d69036fafb34d78f215c335949· first seen 2026-08-14 - Phishing - referenced ·
c60db5fd20231ab59bbe0995ed07c10e· first seen 2026-08-14 - Phishing - referenced ·
fd03f63b87387a347943e8a84e7f86cc· first seen 2026-08-14 - Phishing - referenced ·
d31c4b7a5d10076243ffc663912933a0· first seen 2026-08-14 - 0c9bb327f7da975e5ab9d13d1fe75c377443c01bade1907906d34bdd47572e36 - referenced ·
0c9bb327f7da975e5ab9d13d1fe75c37· first seen 2026-08-14
Antivirus & YARA (1 of 47 engines)
- YARA: delivr.to detections [yara]: DLV_Maldoc_VBA_AutoExec (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Why this verdict
- Antivirus/YARA detection in page content: DLV_Maldoc_VBA_AutoExec
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- WordPress
- Google Analytics
- jQuery
Contacted infrastructure
- 78.140.140.250 - AS35415 Webzilla B.V. (Netherlands)
Observed indicators
- webmodels.studio
- mc.yandex.ru
- fonts.googleapis.com
- ajax.googleapis.com
- code.jquery.com
- www.tenlister.me
- www.themekiller.me
- 78.140.140.250
- https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/160bbd8056bd84---batubaderewopusidex.pdf
- https://mc.yandex.ru/metrika/watch.js
- https://mc.yandex.ru/watch/45143346
- https://fonts.googleapis.com/css?family=Roboto
- https://webmodels.studio/wp-content/themes/Avada/assets/js/html5shiv.js
- https://ajax.googleapis.com/ajax/libs/webfont/1.5.3/webfont.js
- https://webmodels.studio/feed/
- https://webmodels.studio/comments/feed/
- https://webmodels.studio/wp-content/uploads/2017/06/51XXJWSlqGL-1.png
- https://webmodels.studio/wp-content/plugins/formcraft/css/common.css?ver=2.0.3
- https://webmodels.studio/wp-content/plugins/formcraft/css/editor_form.css?ver=2.0.3
- https://webmodels.studio/wp-content/plugins/formcraft/css/fontello/css/formcraft.css?ver=2.0.3
Other scans of webmodels.studio (6)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 20 Aug 2026 - suspicious ·
https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/16138e07b1003 - 17 Aug 2026 - suspicious ·
https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/1607026d795f3 - 15 Aug 2026 - suspicious ·
https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/1607b03487ecf - 14 Aug 2026 - suspicious ·
https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/160725b2194ee - 14 Aug 2026 - suspicious ·
https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/160bb53776ee7 - 12 Aug 2026 - unknown ·
https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/1611311fd67d3
Questions about webmodels.studio
- Is webmodels.studio safe?
- No. MalwareAnalyzer scanned webmodels.studio on 19 Aug 2026 and returned a suspicious verdict with a score of 28 out of 100. Treat it as hostile until it is re-checked.
- What malware is associated with webmodels.studio?
- 20 analysed samples communicate with this URL, including Phishing.
- How was webmodels.studio checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of webmodels.studio
Scanned on MalwareAnalyzer by Cyble · Open interactive scan