The scan of y.de on 21 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with y.de?

2 analysed samples communicate with this URL, including HUILoader.

How was y.de checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

y.de - URL scan, 21 Aug 2026

MalwareAnalyzer by Cyble scanned y.de and returned a unknown verdict (score -12). The page resolved to 172.67.173.90 on Cloudflare, Inc. in US. 2 domains and 1 IP were contacted, over 2 HTTP requests. 2 malware samples communicate with this URL (HUILoader). This is a point-in-time observation from 21 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score -12) · Confidence 15%
Scanned URL: https://y.de/
Domain: y.de · IP: 172.67.173.90 · AS13335 · US
Server: cloudflare
Page title: Domain Verkaufsangebot
HTTP status: 200 · text/html
TLS issuer: C=US, O=Google Trust Services, CN=WE1 · valid to Oct 17 04: · subject CN=y.de
HTTP requests captured: 2
Scan tier: fast · observed 2026-08-21 20:27:49 UTC

Malware communicating with this URL (2)

These samples were observed contacting or being served from y.de. Each links to its full analysis.

HUILoader - referenced · 461e045db059b80d087e4b7a7761c62a · first seen 2026-08-21
68823.pdf - referenced · aad9b4ebf7bdaf9e42a03fb355d323dd · first seen 2026-08-12

Antivirus & YARA (0 of 47 engines)

No engine flagged this page's content.

Why this verdict

Valid TLS, no impersonation or off-origin credential post

Detected technologies

Cloudflare

Contacted infrastructure

172.67.173.90 - AS13335 Cloudflare, Inc. (United States)

Observed indicators

y.de
static.getclicky.com
172.67.173.90
https://y.de/
https://static.getclicky.com/js
https://y.de/cdn-cgi/l/email-protection#c6a5a9a8b2a7a5b286b5b3b6b4a7a2a9aba7afa8b5e8a5a9ab
https://y.de/cdn-cgi/l/email-protection#75161a1b01141601350600050714111a18141c1b065b161a18
https://y.de/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Questions about y.de

Is y.de safe?: The scan of y.de on 21 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with y.de?: 2 analysed samples communicate with this URL, including HUILoader.
How was y.de checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of y.de

Scanned on MalwareAnalyzer by Cyble · Open interactive scan