pdfmaestro.ai
172.67.223.85AS13335 · USthe page states an executable (https://pdfmaestro.ai/PDFMaestroSetup.exe) and the file it delivered was analysed and came back clean; the only context signal is one an honest download page produces (content suppressed for non-Windows visitors).
- Browser Analysisclean
- Content Inspectionclean
- Threat Intelligenceclean
- Network & Hostingclean
- Related Infrastructureclean
- Delivered fileclean
- Domain Intelligenceunknown
- TLS Fingerprintunknown
Looks safe
AutomatedOur automated checks did not find known threat signals on this site at the time of the scan.
What to do
No action needed. Stay alert as usual — a clean result reflects this scan only, and sites can change after they are checked.
A clean result means no known threat signals were found in this scan — it is not an absolute guarantee, and a site can change after it is checked.
Findings
Strongest firstThe page hands the visitor a program to run rather than a document to read. We fetched the file it delivers and the file analyser returned Clean, and every signal that counted here is one an honest download page produces — so this is recorded as what the page does, not as a reason to distrust it.
Analyst noteContext, not an accusation: the executable-delivery suspicion was withdrawn on an explicit Clean file verdict (never on "not Malicious", never on Unknown). If you are re-checking this page, verify the delivered file's publisher and signature — and note that a lure's payload can be validly signed too, which is why the withdrawal also requires that no signal accuses the host or a brand.
The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.
Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.
File
Stored by the engineWhat you download may be live malware. Open it only in an isolated environment, and do not double-click it.
The ZIP is encrypted. Password:infected
Inside the ZIP the file carries a name the engine generated, not the one the page used.
Delivered fileCleanThe engine stored it under a generated name
SHA-2563a08bf40eeccecebcc93397ef4187dd8922aa13ea35d7b6dcc5cf3f4111e2535
Fromhxxps://pdfmaestro[.]ai/PDFMaestroSetup[.]exe
Infrastructure
- IP
- 172.67.223.85CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
- TLS
- CN=WE1, O=Google Trust Services, C=US · expires Dec 2, 2026
- Redirects
- 0 hops · / → /
WHOIS
- Registrar
- GoDaddy.com, LLC
- Organization
- Domains By Proxy, LLC
- Country
- US
- Created
- Nov 12, 2025
- Expires
- Nov 12, 2027
- Nameservers
- dakota.ns.cloudflare.combraelyn.ns.cloudflare.com
Hashes & fingerprints
Page capture
LiveTitle “PDF Maestro - A Simple Solution for All Your PDF Needs | PDF Maestro”
Engines
8 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- PDF Maestro - A Simple Solution for All Your PDF Needs | PDF Maestro
- Load
- 1.88 s · 44 requests