Security Report: soholat.sa - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/27bb025d-1831-4f65-8fbc-6cba101e9291 Domain and IP registration (RDAP)/api/v1/rdap/27bb025d-1831-4f65-8fbc-6cba101e9291How often this domain was scanned/api/v1/domain/stats/soholat.sa Scan history for this domain/api/v1/domain/history/soholat.sa?limit=15

This website contacted 9 IPs in 1 country across 7 domains to perform 122 HTTP transactions. The main domain is soholat.sa.

Submitted URL: https://soholat.sa

AI Security Verdict

Confirmed Scam

Confidence: 94%

Risk Score

Legitimate-looking Saudi marketing site apparently compromised: content is injected with a ClickFix 'Win+X > PowerShell > paste' malware lure behind a fake Cloudflare verification overlay, corroborated by malware threat-intel on the domain and 19 CRITICAL EtherHiding IDS alerts. Do not follow the on-screen steps.

Risk Factors (5)

Known malicious kit: Windows ClickFix Win+X PowerShell/Terminal paste-and-run overlay (family clickfix-winx-overlay-2026-10) injected into page content

Fake Cloudflare 'security verification' overlay with fabricated Ray ID impersonating Cloudflare branding

Primary domain soholat.sa and its URL flagged as malware ('clearfake') by two independent threat-intel feeds

19 CRITICAL IDS alerts for 'ET MALWARE EtherHiding Exfil M2' (network trojan / EtherHiding exfiltration)

Page loads data-seed-prebsc-1-s1.bnbchain.org, a BSC testnet node reported as 'vidar' malware — likely blockchain-based payload/C2 channel

Domain age information unavailable

Details

Page Title

Home | سهولة الوصول

Scan Type

public

Favicon Hash

MMH3: 746399319

MD5: 113f778456bc1941a81b54e744c3568d

Domain Name Analysis

Domain 'soholat.sa' uses the Saudi country-code top-level domain (.sa) while skipping any subdomain. The second-level label 'soholat' is 7 characters long split between three vowels and four consonants. Breaking it apart gives 2 words: soho, lat. The median word length lands at 3.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

‎esi‏ الرئيسية خدماتنا شركاء النجاح بلغة الأرقام آراء العملاء تواصل معنا | | | | ا ‏كيف نعمل في سهولة الوصول؟ ‏من الانطلاق بطموح وحتى الوصول بنجاح.. في كل خطوة نصنع الفارق. ‎as ‎8 ‏7 5 تعمل بجد ل...

Page Load Overview

4.22s

Total Load Time

3.2 MB

Total Size

Language Analysis

Primary Language

🇸🇦Arabic

Code: ar

Confidence:60%

Script:Arabic

Direction:rtl

Detection Details

HTML Lang Attribute:en

Text Length:4,601 chars

Detector Agreement:67%

Language mismatch: Declared as en but detected as ar

Website Classification

Primary Category

corporate business96% confidence

Type: static

Method: ml+structural

All Detected Categories

corporate business

96%

e-commerce shopping

95%

government public service

93%

technology software

69%

blog personal website

61%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
18	104.21.69.162Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
13	142.251.20.95Google · CDN	United States	AS15169Google LLC
13	104.17.207.5Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
13	142.251.14.94Google · CDN	United States	AS15169Google LLC
13	172.67.210.91Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
13	3.33.155.121Aws · CLOUD	United States	AS16509Amazon.com, Inc.
13	34.111.175.102Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
13	104.21.27.152Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
13	15.197.152.159Aws · CLOUD	United States	AS16509Amazon.com, Inc.
122	9	-	-