No. MalwareAnalyzer scanned thermcom.cz on 15 Aug 2026 and returned a suspicious verdict with a score of 46 out of 100. Treat it as hostile until it is re-checked.

What malware is associated with thermcom.cz?

1 analysed samples communicate with this URL, including Phishing.

How was thermcom.cz checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

thermcom.cz - suspicious URL scan, 15 Aug 2026

MalwareAnalyzer by Cyble scanned thermcom.cz and returned a suspicious verdict (score 46). The page resolved to 95.168.204.20 on Tlap s.r.p. in CZ. The domain was registered 6107 days ago through REG-INTERNET-CZ. 24 domains and 1 IP were contacted, over 13 HTTP requests. 1 malware sample communicates with this URL (Phishing). This is a point-in-time observation from 15 Aug 2026; the page may have changed since.

Scan result

Verdict: suspicious (score 46) · Confidence 52%
Scanned URL: http://thermcom.cz/userfiles/file/devexunosobemofizi.pdf
Domain: thermcom.cz · IP: 95.168.204.20 · AS39392 · CZ
Server: Apache/2.2.9 (Debian) DAV/2 PHP/5.2.6-1+lenny16 with Suhosin-Patch mod_ssl/2.2.9 OpenSSL/0.9.8g
Page title: Kompletní revitalizace panelových domů, domů obytných a rodinných domů | www.thermcom.cz
HTTP status: 200 · text/html
Registrar: REG-INTERNET-CZ · domain age 6107 days · created 2009-11-25
HTTP requests captured: 13
Scan tier: fast · observed 2026-08-15 12:29:26 UTC

Malware communicating with this URL (1)

These samples were observed contacting or being served from thermcom.cz. Each links to its full analysis.

Phishing - referenced · 4bec355558593534658a4238bb88e19e · first seen 2026-08-15

Antivirus & YARA (1 of 44 engines)

YARA: SophosLabs IoCs (public) [yara]: SOPHOS_Gootloader_JS (page content)

These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.

Why this verdict

Antivirus/YARA detection in page content: SOPHOS_Gootloader_JS
Served over plaintext HTTP

Detected technologies

Apache
PHP

Contacted infrastructure

95.168.204.20 - AS39392 Tlap s.r.p. (Czechia)

Observed indicators

thermcom.cz
dektrade.cz
www.staviva.cz
www.weber-terranova.cz
www.basf-cc.cz
www.lodzie.cz
www.okcz.cz
www.bajergroup.cz
www.plastoma.com
www.plastikov.cz
www.mgreal.cz
www.sepos.cz
www.stunexcz.com
www.strechy92.cz
www.elsa-cz.cz
www.vytahy.com
www.votop.cz
www.sdzprofin.cz
www.sezev-reko.cz
www.chladek-tintera.cz

Other scans of thermcom.cz (4)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

15 Aug 2026 - suspicious
15 Aug 2026 - suspicious
15 Aug 2026 - suspicious
15 Aug 2026 - suspicious

Questions about thermcom.cz

Is thermcom.cz safe?: No. MalwareAnalyzer scanned thermcom.cz on 15 Aug 2026 and returned a suspicious verdict with a score of 46 out of 100. Treat it as hostile until it is re-checked.
What malware is associated with thermcom.cz?: 1 analysed samples communicate with this URL, including Phishing.
How was thermcom.cz checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of thermcom.cz

Scanned on MalwareAnalyzer by Cyble · Open interactive scan