The scan of www.g.de on 22 Aug 2026 reached no verdict either way (score -2). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with www.g.de?

1 analysed samples communicate with this URL, including Finfish.

How was www.g.de checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

www.g.de - URL scan, 22 Aug 2026

MalwareAnalyzer by Cyble scanned www.g.de and returned a unknown verdict (score -2), categorised as credential-harvest. The page resolved to 157.90.66.230 on Hetzner Online GmbH in DE. 8 domains and 1 IP were contacted. 1 malware sample communicates with this URL (Finfish). The request followed 1 redirect before landing. This is a point-in-time observation from 22 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score -2) · Confidence 8%
Scanned URL: https://g.de/
Domain: www.g.de · IP: 157.90.66.230 · AS24940 · DE
Server: nginx/1.22.1
Page title: Willkommen - G.de - die GutscheinbÃ¶rse
HTTP status: 200 · text/html; charset=UTF-8
TLS issuer: C=US, O=Let's Encrypt, CN=YE1 · valid to Oct 9 12: · subject CN=g.de
Scan tier: fast · observed 2026-08-22 10:39:27 UTC

Redirect chain

https://g.de/
https://www.g.de/

Malware communicating with this URL (1)

These samples were observed contacting or being served from www.g.de. Each links to its full analysis.

Finfish - referenced · 05a208e7f396c42d5f955867ee6eec83 · first seen 2026-08-22

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Why this verdict

Valid TLS, no impersonation or off-origin credential post
Credential-harvesting form

Detected technologies

Nginx
Google Analytics

Contacted infrastructure

157.90.66.230 - AS24940 Hetzner Online GmbH (Germany)

Observed indicators

www.g.de
www.facebook.com
twitter.com
www.xn--preisgnstig-yhb.de
www.neuekreditkarte.de
www.styleshout.com
validator.w3.org
jigsaw.w3.org
157.90.66.230
https://www.g.de/
https://www.g.de/images/BrightSide.css
https://www.g.de/style/style.css
https://www.g.de/images/logo.png
https://www.g.de/index.htm
https://www.g.de/gutscheine-neu-1.htm
https://www.g.de/gutscheine-beliebt-1.htm
https://www.g.de/gutscheine-letzte_chance-1.htm
https://www.g.de/anbieteruebersicht.htm
https://www.g.de/images/headerphoto.png
https://www.facebook.com/rabattgutscheincodes

Questions about www.g.de

Is www.g.de safe?: The scan of www.g.de on 22 Aug 2026 reached no verdict either way (score -2). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with www.g.de?: 1 analysed samples communicate with this URL, including Finfish.
How was www.g.de checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of www.g.de

Scanned on MalwareAnalyzer by Cyble · Open interactive scan