www.zd.ws - URL scan, 23 Aug 2026
MalwareAnalyzer by Cyble scanned www.zd.ws and returned a unknown verdict (score 18), categorised as credential-harvest. The page resolved to 86.105.245.69 on Signet B.V. in NL. 7 domains and 1 IP were contacted, over 5 HTTP requests. 2 malware samples communicate with this URL. The request followed 1 redirect before landing. This is a point-in-time observation from 23 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 18) · Confidence 24%
- Scanned URL:
https://zd.ws/ - Domain: www.zd.ws · IP: 86.105.245.69 · AS20857 · NL
- Server: openresty/1.21.4.1
- Page title: ZD.WS
- HTTP status: 200 · text/html; charset=UTF-8
- TLS issuer: C=US, O=Let's Encrypt, CN=YR2 · valid to Nov 17 05: · subject CN=zd.ws
- HTTP requests captured: 5
- Scan tier: fast · observed 2026-08-23 22:32:37 UTC
Redirect chain
https://zd.ws/https://www.zd.ws/
Malware communicating with this URL (2)
These samples were observed contacting or being served from www.zd.ws. Each links to its full analysis.
- ec3ed010d4f240b276138b3431e816f64179220798593078042de506172590b4 - referenced ·
ec3ed010d4f240b276138b3431e816f6· first seen 2026-08-23 - 8a5283e1185b65dbe27a80e1160c3c6d74d7b2b9f617d56b0f6b3e08df34a116 - referenced ·
8a5283e1185b65dbe27a80e1160c3c6d· first seen 2026-08-22
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Categories
- credential-harvest
Why this verdict
- Credential-harvesting form
- Untrusted certificate (UNABLE_TO_VERIFY_LEAF_SIGNATURE)
Detected technologies
- Google Analytics
- jQuery
- Bootstrap
Contacted infrastructure
- 86.105.245.69 - AS20857 Signet B.V. (Netherlands)
Observed indicators
- www.zd.ws
- stackpath.bootstrapcdn.com
- fonts.googleapis.com
- use.fontawesome.com
- cdn.jsdelivr.net
- www.googletagmanager.com
- code.jquery.com
- 86.105.245.69
- https://www.zd.ws/
- https://www.zd.ws/img/y.png
- https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css
- https://fonts.googleapis.com/css?family=Oswald:400,700
- https://www.zd.ws/css/page_specific/landing_themes/indrp_fresku/style.css
- https://www.zd.ws/css/page_specific/landing_themes/loading_spinner.css
- https://use.fontawesome.com/releases/v5.6.3/css/all.css
- https://cdn.jsdelivr.net/gh/altcha-org/altcha/dist/altcha.min.js
- https://www.zd.ws/css/altcha.css
- https://www.googletagmanager.com/gtag/js?id=UA-51651642-1
- https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700
- https://code.jquery.com/jquery-3.3.1.min.js
Other scans of www.zd.ws (1)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 22 Aug 2026 - unknown
Questions about www.zd.ws
- Is www.zd.ws safe?
- The scan of www.zd.ws on 23 Aug 2026 reached no verdict either way (score 18). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with www.zd.ws?
- 2 analysed samples communicate with this URL.
- How was www.zd.ws checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of www.zd.ws
Scanned on MalwareAnalyzer by Cyble · Open interactive scan