Is xn--o39a91gvwm83kbsn.net safe?

No. MalwareAnalyzer scanned xn--o39a91gvwm83kbsn.net on 22 Aug 2026 and returned a suspicious verdict with a score of 36 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.

What malware is associated with xn--o39a91gvwm83kbsn.net?

5 analysed samples communicate with this URL, including Phishing.

How was xn--o39a91gvwm83kbsn.net checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

xn--o39a91gvwm83kbsn.net - suspicious URL scan, 22 Aug 2026

MalwareAnalyzer by Cyble scanned xn--o39a91gvwm83kbsn.net and returned a suspicious verdict (score 36), categorised as phishing. The page resolved to 114.108.145.220 on IP Manager in KR. The domain was registered 2950 days ago through Gabia, Inc.. 1 domain and 1 IP were contacted. 5 malware samples communicate with this URL (Phishing). This is a point-in-time observation from 22 Aug 2026; the page may have changed since.

Scan result

Verdict: suspicious (score 36) · Confidence 42%
Scanned URL: http://xn--o39a91gvwm83kbsn.net/FileData/ckfinder/files/20210908_CD449914E131EF15.pdf
Domain: xn--o39a91gvwm83kbsn.net · IP: 114.108.145.220 · AS3786 · KR
Server: Apache
Page title: 404 Not Found
HTTP status: 404 · text/html; charset=iso-8859-1
Registrar: Gabia, Inc. · domain age 2950 days · created 2018-07-24
Scan tier: fast · observed 2026-08-22 05:51:47 UTC

Malware communicating with this URL (5)

These samples were observed contacting or being served from xn--o39a91gvwm83kbsn.net. Each links to its full analysis.

Phishing - referenced · befd6be22b6900b7885ad033132bde08 · first seen 2026-08-22
Phishing - referenced · 7fda84e2da1592928c103945e4f302c3 · first seen 2026-08-19
Phishing - referenced · b5f8e9e8e7dce56b412a5b61599982ee · first seen 2026-08-17
Phishing - referenced · 5d705a69fac22452e49c21fff569ddcd · first seen 2026-08-15
Phishing - referenced · 3b74afa8c6f78be3836969f46d8623dd · first seen 2026-08-14

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Why this verdict

Homograph / mixed-script domain (IDN spoofing)
Served over plaintext HTTP

Detected technologies

Apache

Contacted infrastructure

114.108.145.220 - AS3786 IP Manager (KR)

Observed indicators

xn--o39a91gvwm83kbsn.net
114.108.145.220
http://xn--o39a91gvwm83kbsn.net/FileData/ckfinder/files/20210908_CD449914E131EF15.pdf

Other scans of xn--o39a91gvwm83kbsn.net (1)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

15 Aug 2026 - suspicious · http://xn--o39a91gvwm83kbsn.net/FileData/ckfinder/files/20210907_8367025E3A926160.pdf

Questions about xn--o39a91gvwm83kbsn.net

Is xn--o39a91gvwm83kbsn.net safe?: No. MalwareAnalyzer scanned xn--o39a91gvwm83kbsn.net on 22 Aug 2026 and returned a suspicious verdict with a score of 36 out of 100, categorised as phishing. Treat it as hostile until it is re-checked.
What malware is associated with xn--o39a91gvwm83kbsn.net?: 5 analysed samples communicate with this URL, including Phishing.
How was xn--o39a91gvwm83kbsn.net checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of xn--o39a91gvwm83kbsn.net

Scanned on MalwareAnalyzer by Cyble · Open interactive scan