Is ww19.downingmsband.com safe?

No. MalwareAnalyzer scanned ww19.downingmsband.com on 19 Aug 2026 and returned a suspicious verdict with a score of 20 out of 100, categorised as suspicious-infrastructure. Treat it as hostile until it is re-checked.

How was ww19.downingmsband.com checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

ww19.downingmsband.com - suspicious URL scan, 19 Aug 2026

MalwareAnalyzer by Cyble scanned ww19.downingmsband.com and returned a suspicious verdict (score 20), categorised as suspicious-infrastructure. The page resolved to 208.91.196.145 on Confluence Networks Inc in US. 2 domains and 2 IPs were contacted. The request followed 1 redirect before landing. This is a point-in-time observation from 19 Aug 2026; the page may have changed since.

Scan result

Verdict: suspicious (score 20) · Confidence 26%
Scanned URL: http://sovome.downingmsband.com/uploads/1/3/1/3/131380177/7ab0647b4ac.pdf
Domain: ww19.downingmsband.com · IP: 208.91.196.145 · AS40034 · US
Server: nginx/1.28.0
HTTP status: 200 · text/html
Scan tier: standard · observed 2026-08-19 21:58:43 UTC

Redirect chain

http://sovome.downingmsband.com/uploads/1/3/1/3/131380177/7ab0647b4ac.pdf
http://ww19.downingmsband.com/

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Why this verdict

Algorithmically-generated (DGA-like) hostname
Served over plaintext HTTP

Detected technologies

Nginx

Contacted infrastructure

208.91.196.145 - AS40034 Confluence Networks Inc (United States)
172.241.213.98 - AS395954 LeaseWeb USA, Inc. Los Angeles (United States)

Observed indicators

ww19.downingmsband.com
l.cdn-fileserver.com
208.91.196.145
172.241.213.98
http://ww19.downingmsband.com/
http://ww19.downingmsband.com/1
https://l.cdn-fileserver.com/bping.php?mspa=0&r=1787176725050&vgd_cage=40&vgd_setup=c21&ugd=0&cc=AU&wshp=0&vgd_tsce=L1326&vgd_cdv=O3435&vgd_oreqf=one&crid=342704488&sc=NSW&lper=100&requrl=https%3A%2F%2Fdowningmsband.com&vgd_rpth=%2Fola&gdpr=0&vgd_oresf=one&vgd_wlstp=0&vgd_asn=16509&prid=8PR11258V&cid=8CU7G8B38&vi=1787176725656895115&hvsid=00001787176725049009194926083349&wsip=170763874&ssld=%7B%22QQNN%22%3A%22KP%22%2C%22QQN75%22%3A%22Q5OzJ5%22%2C%22QQ8E%22%3A%22%22%2C%22QQQN%22%3A%22Ibp%22%2C%22QQl8E%22%3A%22%22%7D&vgd_l2type=dmola&lf=6&vgd_len=562&vgd_end=1

Questions about ww19.downingmsband.com

Is ww19.downingmsband.com safe?: No. MalwareAnalyzer scanned ww19.downingmsband.com on 19 Aug 2026 and returned a suspicious verdict with a score of 20 out of 100, categorised as suspicious-infrastructure. Treat it as hostile until it is re-checked.
How was ww19.downingmsband.com checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the standard tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of ww19.downingmsband.com

Scanned on MalwareAnalyzer by Cyble · Open interactive scan