www.elsevier.support - URL scan, 15 Aug 2026
MalwareAnalyzer by Cyble scanned www.elsevier.support and returned a unknown verdict (score 0). The page resolved to 104.18.35.58 on Cloudflare, Inc. in US. The domain was registered 2906 days ago through SafeNames Ltd.. 4 domains and 2 IPs were contacted, over 13 HTTP requests. 1 malware sample communicates with this URL (QQpass). The request followed 1 redirect before landing. This is a point-in-time observation from 15 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 0) · Confidence 6%
- Scanned URL:
https://service.elsevier.com/app/answers/detail/a_id/22094/kw/migrate/supporthub/mendeley/ - Domain: www.elsevier.support · IP: 104.18.35.58 · AS13335 · US
- Server: cloudflare
- Page title: How can I migrate data from one PC to another? | Mendeley Support Center
- HTTP status: 200 · text/html; charset=utf-8
- Registrar: SafeNames Ltd. · domain age 2906 days · created 2018-08-30
- TLS issuer: C=US, O=Google Trust Services, CN=WE1 · valid to Oct 31 16: · subject CN=elsevier.support
- HTTP requests captured: 13
- Scan tier: fast · observed 2026-08-15 00:17:15 UTC
Redirect chain
https://service.elsevier.com/app/answers/detail/a_id/22094/kw/migrate/supporthub/mendeley/https://www.elsevier.support/mendeley/answer/how-can-i-migrate-data-from-one-pc-to-another
Malware communicating with this URL (1)
These samples were observed contacting or being served from www.elsevier.support. Each links to its full analysis.
- QQpass - referenced ·
812f5128071874e5333f08808fa30fd6· first seen 2026-08-15
Antivirus & YARA (1 of 44 engines)
- YARA: JPCERT/CC [yara]: JPCERT_Emotet (page content)
These signatures matched text in the page. Pages that quote or document malware can match them, so on their own they do not make a page malicious.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
- A signature matched text in the page (JPCERT_Emotet) — pages that discuss malware can match, so this alone is not a malicious verdict
Detected technologies
- Cloudflare
- Amazon CloudFront
- Next.js
Contacted infrastructure
- 104.18.35.58 - AS13335 Cloudflare, Inc. (United States)
- 147.154.237.60 - AS31898 Oracle Public Cloud (United Kingdom)
Observed indicators
- www.elsevier.support
- www.mendeley.com
- www.relx.com
- www.elsevier.com
- 104.18.35.58
- 147.154.237.60
- https://www.elsevier.support/mendeley/answer/how-can-i-migrate-data-from-one-pc-to-another
- https://www.elsevier.support/images/elsevier-favicon.png
- https://www.elsevier.support/images/elsevier-apple-touch-icon.png
- https://www.elsevier.support/_next/static/css/20b8a27088061fdd.css
- https://www.elsevier.support/_next/static/css/a1d02f27b1a4ef23.css
- https://www.elsevier.support/_next/static/chunks/polyfills-42372ed130431b0a.js
- https://www.elsevier.support/_next/static/chunks/webpack-7ce44e2fd3d4e99b.js
- https://www.elsevier.support/_next/static/chunks/framework-ef8776bd50c27486.js
- https://www.elsevier.support/_next/static/chunks/main-fe491be16d97a7aa.js
- https://www.elsevier.support/_next/static/chunks/pages/_app-469fcd030dcfcc75.js
- https://www.elsevier.support/_next/static/chunks/c2a77f4d-5e973698bcc8dc38.js
- https://www.elsevier.support/_next/static/chunks/8005-9c2369a109f9b2e2.js
- https://www.elsevier.support/_next/static/chunks/1796-2e2da20a367839c2.js
- https://www.elsevier.support/_next/static/chunks/3433-83f5fd915f5a7642.js
Other scans of www.elsevier.support (7)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 21 Aug 2026 - unknown ·
https://www.elsevier.support/mendeley - 21 Aug 2026 - unknown
- 20 Aug 2026 - unknown ·
https://www.elsevier.support/mendeley - 20 Aug 2026 - unknown
- 19 Aug 2026 - unknown ·
https://www.elsevier.support/mendeley - 19 Aug 2026 - unknown
- 15 Aug 2026 - unknown ·
https://www.elsevier.support/mendeley
Questions about www.elsevier.support
- Is www.elsevier.support safe?
- The scan of www.elsevier.support on 15 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with www.elsevier.support?
- 1 analysed samples communicate with this URL, including QQpass.
- How was www.elsevier.support checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of www.elsevier.support
Scanned on MalwareAnalyzer by Cyble · Open interactive scan