Scan report · 2 days agoPublic

aircruzas.com

104.207.79.65AS22612 · US
Landed onabout:blank

Suspicious: behavioural signals scored 4 (threshold 4)

all of it from handing over a file rather than rendering a page; see the findings list
Engine tags
Verdict

What happened

Step by step, from what the scanner recorded.
Load 0.8 s · 1 requests
01 · Visitor opensaircruzas.com
02 · Redirected · 1 hopblank
03 · Page shown
aircruzas.com
04 · File delivered · maliciousDCPp.js

Dangerous — confirmed threat

Automated

The file it serves was analysed and found malicious. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first
MalwareMalware found in the downloaded file
DCPp.js

Our Content Inspection engine downloaded the file this URL serves and analyzed it as a real payload — it matched known malware. Do not open or run this file.

Success

SHA-256 8d6044c57c01dd009486646b6289c0995458ef24e959bccf8e3905edbcdb9229

StrongPage auto-started a file download
DCPp.js

The page automatically triggered a file download. Normal landing pages don't do this; malware droppers do.

Analyst noteCheck the file name/type. An auto-download of an executable or archive is a strong malware-delivery tell.

File

Stored by the engine

What you download may be live malware. Open it only in an isolated environment, and do not double-click it.

The ZIP is encrypted. Password:infected

Inside the ZIP the file carries a name the engine generated, not the one the page used.

Downloaded fileMaliciousDCPp.js

SHA-2568d6044c57c01dd009486646b6289c0995458ef24e959bccf8e3905edbcdb9229

Fromhxxps://aircruzas[.]com/

Infrastructure

IP
104.207.79.65NAMECHEAP-NET - Namecheap, Inc., US · AS22612US
TLS
CN=SSL.com TLS Issuing RSA CA R1, O=SSL Corporation, C=US · expires Apr 9, 2027
Redirects
0 hops · / → blank

WHOIS

Registrar
NameCheap, Inc.
Created
Sep 23, 2026
Expires
Sep 23, 2027
Nameservers
dns1.namecheaphosting.comdns2.namecheaphosting.com
59 malicious71 suspicious

Hashes & fingerprints

Page capture

Live

Engines

7 · time to verdict

Page

HTTP
— · DownloadOnly
Load
0.76 s · 1 requests