Security Scan: www.wales.nhs.uk

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 1 HTTP transaction. The main domain is wales.nhs.uk.

Submitted URL: http://www.wales.nhs.uk/sites3/home.cfm?orgid=220

The Cisco Umbrella rank of the primary domain is #271,097 of the top 1 million websites

AI Security Verdict

Low Risk

Confidence: 78%

Risk Score

The site shows no malicious forms or IoC hits; minor risk stems from low ranking and redirects, but overall appears legitimate.

Risk Factors

Low domain ranking (#271,097) for a site claiming a well‑known brand

Circular redirect chain (potentially malicious or misconfiguration)

Multiple eval() calls in JavaScript (suspicious but not confirmed malicious)

Safety Factors

Self‑branding – the site presents its own brand, not impersonating another entity

Absence of credential or payment collection forms

No Indicators of Compromise or IDS alerts

No malicious YARA matches in JavaScript

Verdict cited a credential/login form, but DOM analysis found no password field (real or disguised) or payment field, and no other hard signal — credential-phishing framing unsupported; risk adjusted from 4 to 3

Domain age information unavailable

Details

Page Title

www.wales.nhs.uk

Scan Type

public

Language

🇺🇸

English

(80% confidence)

Screenshot

Page Load Overview

8.09s

Total Load Time

HTTP Requests

Domains

N/A

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

Language Code:en

Detection Confidence:80%

Script Type:Latin

HTML Lang Attribute:en

Text Length:744 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software84% confidence

Type: static

Method: ml+structural

All Detected Categories

technology software

84%

documentation technical

62%

adult content

53%

government public service

34%

phishing/scam

20%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	212.102.56.178	Frankfurt am Main, Hesse, Germany	AS60068Datacamp Limited
0	51.142.213.179Azure · CLOUD	London, England, United Kingdom	AS8075Microsoft Corporation
0	20.26.146.238Azure · CLOUD	London, England, United Kingdom	AS8075Microsoft Corporation
0	192.178.183.97Google · CDN	United States	AS15169Google LLC
3	4	-	-

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1E7048F77329A063986558498E05B830D9F20B143F506C9BC79BCBAD9BFDED06107BB78

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:L/Qho9PKBb9Js3q9Jzbs6tlg1ySBKwdQ9gcoIsPj2bMy8Old2:MhoC9JSqzzbs6okSjggcpsL2eAY

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:187943:FQIlTT1kwAipFqQ0CEaQsIEQGhAwQFTAjNKZXZkDZBBAtHQWBjaNwCQkqwEfIEhEjEAMUCLsjSgFTp9o6IAJEiwIaRiMIKOB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffc7c7c3d3ffffff

Perceptual Hash:b1339acccc93b364

Difference Hash:0018181616000000

Wavelet Hash:fcdcc4c4c0f0f0f0

Color Hash:#d22d72

Other Hashes

Crop Resistant:0018181616000000

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: www.wales.nhs.uk