ScanMalware.com

Security Scan Report: nilehotel.co.ug

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/262d17f9-54d7-4593-9443-a7129b487a5eDomain and IP registration (RDAP)/api/v1/rdap/262d17f9-54d7-4593-9443-a7129b487a5eHow often this domain was scanned/api/v1/domain/stats/nilehotel.co.ugScan history for this domain/api/v1/domain/history/nilehotel.co.ug?limit=15
This website contacted 4 IPs in 1 country across 5 domains to perform 47 HTTP transactions. The main domain is nilehotel.co.ug.

Submitted URL: https://nilehotel.co.ug

AI Security Verdict

High Risk

Confidence: 88%

8
Risk Score

Legitimate Ugandan hotel-asset company site that has been compromised: ClearFake malware loader and defacement/SEO-spam injections detected. Do not visit or interact until cleaned.

Risk Factors (5)
Known malicious kit (ClearFake) identified on the page by YARA — active malware/phishing loader
Primary domain flagged as a malware loader in threat intelligence
Site defaced ('Hacked By Chinafans') indicating an unpatched compromise
Injected casino/gambling SEO spam content unrelated to the legitimate business
Obfuscator-pattern network alerts consistent with injected script
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

Within the Ugandan country-code top-level domain (.co.ug), 'nilehotel.co.ug' is registered while skipping any subdomain. The registrable portion 'nilehotel' spans 9 characters split between 4 vowels and 5 consonants. Tokenizing the label suggests two words: nile, hotel. Average segment length settles at 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://nilehotel.co.ug

Page Load Overview

4.92s
Total Load Time
2.2 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:5,571 chars
Detector Agreement:67%

Website Classification

Primary Category

real estate property30% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

real estate property
30%
forum
25%
news/blog
20%

Detected Features

Articles
Comments

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1474.50.69.122United States
AS19318Interserver, Inc
11142.251.110.95Google · CDNUnited States
AS15169Google LLC
11104.21.27.152Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
11142.251.14.94Google · CDNUnited States
AS15169Google LLC
474--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1BF931872834C08BA321F87849C7AF71DF5A55885DE86069EF2BEA34097CC9F550B724E

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:OYypohoIIB7u8Ij0z+djiIVENXHhjoBXKekXiJ4MIpDuQriMGb/IYQlWOM/7tU1U:O5Sh6u8Ij0z+djiIVENXhjoJKeaiJxIa

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:95932:wFpIYMChiASQkVPAnQHpXWbMMJSCAQmoBZIUFAIGCgCdHYEt2yREF3IMABIAEGd5eBhIIABM4IQ1iAGAQzHJICKngnMHwDLE

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fefeffffffffffff
Perceptual Hash:d5555555553788aa
Difference Hash:0000000800000000
Wavelet Hash:fefefee602120202
Color Hash:#78533a

Other Hashes

Crop Resistant:0000000800000000

Scan History

Scan history not available

Unable to load historical scan data