www.histats.com - suspicious URL scan, 22 Aug 2026
MalwareAnalyzer by Cyble scanned www.histats.com and returned a suspicious verdict (score 24), categorised as credential-harvest. The page resolved to 104.20.3.84 on Cloudflare, Inc. in US. 8 domains and 1 IP were contacted, over 6 HTTP requests. 13 malware samples communicate with this URL. This is a point-in-time observation from 22 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 24) · Confidence 30%
- Scanned URL:
http://www.histats.com/ - Domain: www.histats.com · IP: 104.20.3.84 · AS13335 · US
- Server: cloudflare
- Page title: Histats.com Counter ,the free web stats and stat counter, hit counter, free web tracker and tracking tools, professional and free!!
- HTTP status: 200 · text/html; charset=UTF-8
- HTTP requests captured: 6
- Scan tier: fast · observed 2026-08-22 10:22:00 UTC
Malware communicating with this URL (13)
These samples were observed contacting or being served from www.histats.com. Each links to its full analysis.
- 5228014d101fcceeef03a13003dd8acc4d4c1f6da36d33ac96a41d6a3c777893 - referenced ·
5228014d101fcceeef03a13003dd8acc· first seen 2026-08-22 - 3f7a85a5b1f754754520e27172ee7400c454e9b678af4951c90648190b3305c2 - referenced ·
3f7a85a5b1f754754520e27172ee7400· first seen 2026-08-22 - 3f76b6dcb28c2d15abc29de9cff0bdf0629bbfae3e61608216406ed3b657d17a - referenced ·
3f76b6dcb28c2d15abc29de9cff0bdf0· first seen 2026-08-21 - 3234fe9827e963b9e48f97f2d78aeecf1103e8b45ddb2298e0f81e08c0ff39db - referenced ·
3234fe9827e963b9e48f97f2d78aeecf· first seen 2026-08-21 - 3238d62b83b80af05528be6cd7264cd75cdddb63261831d9e79a3e9847cee68b - referenced ·
3238d62b83b80af05528be6cd7264cd7· first seen 2026-08-21 - 5cf79f8b58b946bd938e5343eb2becbbc12fd8e786f65248baa10fff56c6aa44 - referenced ·
5cf79f8b58b946bd938e5343eb2becbb· first seen 2026-08-20 - 9901b2d5a20e98ed517f02c26d57996557077d9effc93d4706be555e725357e4 - referenced ·
9901b2d5a20e98ed517f02c26d579965· first seen 2026-08-20 - 6adf75bc93c63ae98b326e8d8daf5b5bd44b641c942b0c59be4641721d7a765e - referenced ·
6adf75bc93c63ae98b326e8d8daf5b5b· first seen 2026-08-18 - 408c410dcecebf51f38b86903fdc7af16bd33671a8f06110b066a25b141acc73 - referenced ·
408c410dcecebf51f38b86903fdc7af1· first seen 2026-08-16 - 5029f6bccf92fdb232b355e823b828a91be5b5e1557f5dfc0e9dcbacb7640dca - referenced ·
5029f6bccf92fdb232b355e823b828a9· first seen 2026-08-15 - 3fbb1dc2e88cc9515d301f467144cfb6e0467e2890fb30fd22a1084acf6c4b17 - referenced ·
3fbb1dc2e88cc9515d301f467144cfb6· first seen 2026-08-13 - 377e124ff2b406e2f4c35c17f8179eaa3e41931003069889d2ca2c5b7531a8de - referenced ·
377e124ff2b406e2f4c35c17f8179eaa· first seen 2026-08-12 - 3771cb9c615333a7230796d7df10fa643e9e7883bd90f6a0fbfb630ec5fe27c0 - referenced ·
3771cb9c615333a7230796d7df10fa64· first seen 2026-08-12
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Categories
- credential-harvest
Why this verdict
- Credential-harvesting form
- Served over plaintext HTTP
Detected technologies
- Cloudflare
- Google Analytics
Contacted infrastructure
- 104.20.3.84 - AS13335 Cloudflare, Inc. (United States)
Observed indicators
- www.histats.com
- i.histats.com
- twitter.com
- www.facebook.com
- www.youtube.com
- pagead2.googlesyndication.com
- sstatic1.histats.com
- www.googletagmanager.com
- 104.20.3.84
- http://www.histats.com/
- http://www.histats.com/favicon.ico
- http://i.histats.com/vigomin/css_min/931031e411c1f02f538a36b556e0c726.min.css
- http://www.histats.com/css/CSS_dropDwn_ie.css
- http://i.histats.com/images/top_logo/svg-spot-1.png
- http://i.histats.com/images/top_logo/svg-spot-2.png
- http://i.histats.com/images/top_logo/svg-spot-3.png
- http://twitter.com/histatscom
- http://i.histats.com/images/ICO_1px.gif
- http://www.facebook.com/pages/histatscom/124026010991543
- http://www.histats.com/viewstats/?DOLOGIN=1
Other scans of www.histats.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 23 Aug 2026 - malicious ·
http://khasiatkolagenrumpailaut.blogspot.com/search/label/khasiatrumpailauthijaugredaaaa - 23 Aug 2026 - unknown ·
http://fadlijayamotor.blogspot.com/2016/09/cdi-toyota-kijang-kapsul-karbulator-7k.html - 22 Aug 2026 - unknown ·
http://mawardimasuraijambi.blogspot.com/2014/08/buku-pegangan-guru-matematika-kelas.html - 22 Aug 2026 - unknown ·
http://borneosensasi.blogspot.com/2014/01/awas-alat-curi-wi-fi.html - 22 Aug 2026 - unknown ·
http://jekethek.blogspot.com/search/label/Tukar%20Link%20di%20Sini - 21 Aug 2026 - unknown ·
https://dogoxuavanay.vn/uploads/files/37343936202.pdf - 21 Aug 2026 - unknown ·
https://dogoxuavanay.vn/uploads/files/37343936202.pdf - 21 Aug 2026 - suspicious ·
http://rifuzzy.blogspot.com/2010/02/arah-kiblat-320000-masjid-bergeser.html - 21 Aug 2026 - suspicious ·
https://ankiitpatel.blogspot.com/search/label/c%20language - 21 Aug 2026 - suspicious ·
http://berkah2013.blogspot.com/2013/07/
Questions about www.histats.com
- Is www.histats.com safe?
- No. MalwareAnalyzer scanned www.histats.com on 22 Aug 2026 and returned a suspicious verdict with a score of 24 out of 100, categorised as credential-harvest. Treat it as hostile until it is re-checked.
- What malware is associated with www.histats.com?
- 13 analysed samples communicate with this URL.
- How was www.histats.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of www.histats.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan