Security Scan Report: albalad-news.net

Site favicon
Submitted: Completed: publiccompleted
This website contacted 37 IPs in 3 countries across 26 domains to perform 305 HTTP transactions. The main domain is albalad-news.net and was registered 4 years 8 months ago.

Submitted URL: https://albalad-news.net

AI Security Verdict

High Risk

Confidence: 78%

8
Risk Score

Established self-branded Sudanese news site, but the primary domain is a multi-source corroborated ClearFake malware Indicator of Compromise and the page loads testnet blockchain RPCs and suspicious ad scripts — treat as a likely compromised site serving malware.

Risk Factors (4)
Primary-domain Indicators of Compromise match, multi-source corroborated, threat type 'clearfake (malware)'
Blockchain testnet RPC endpoints loaded by a non-crypto news page
HIGH-severity IDS alerts for .cc TLD DNS queries
Ad/CDN script hosts loaded from multiple third-party domains on a WordPress-style news site
Domain age information unavailable

Details

Page Title

الرئيسية - البلد نيوز

Scan Type

public

Domain Name Analysis

The domain 'albalad-news.net' uses the network infrastructure generic top-level domain (.net) without a subdomain. Count 12 characters in 'albalad-news' containing 4 vowels alongside seven consonants, notching one hyphen. Segmentation suggests 3 words: al, balad, news. The median word length lands at four characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://albalad-news.net

Page Load Overview

35.86s
Total Load Time
3.8 MB
Total Size

Language Analysis

Primary Language

🇸🇦Arabic
Code: ar
Confidence:80%
Script:Arabic
Direction:rtl

Detection Details

HTML Lang Attribute:ar
Text Length:15,867 chars
Detector Agreement:80%

Website Classification

Primary Category

social media network84% confidence
Type: spa
Method: ml+structural

All Detected Categories

social media network
84%
news media journalism
41%
entertainment media
39%
corporate
35%

Detected Features

Search
OG: website
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
1778.31.64.245Germany
AS24961WIIT AG
8192.178.183.95Google · CDNUnited States
AS15169Google LLC
8192.0.77.37San Francisco, California, United States
AS2635Automattic, Inc
8142.250.154.155Google · CDNUnited States
AS15169Google LLC
8138.199.37.230Datacamp · CDNFrankfurt am Main, Hesse, Germany
AS60068Datacamp Limited
8192.0.76.3San Francisco, California, United States
AS2635Automattic, Inc
815.197.198.189Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
852.223.48.152Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
83.33.155.121Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
8104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
30537--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T167F43D1BA5E21A33C29686E991733B7C6F3D8D2E8FC15C746A43276E478ADE306440DD

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:L4eNbErcCnQPve9cRCgM4IsZmtSOnZZttOwZctwO21yeFIv9o3nmFCgM4ISZstc/:FYcCnCve9M3

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:733893:SFBHcqLZqS8BIiAEKByAQCgJ6kkBVBWBAQRAgRuUAICAAEdWJAHAzUDm+IZIQbATAtLmlTBAg5CBCWREptMGAgREGHCYABSQ

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:fd793ffffff3f3c3
Perceptual Hash:ed936d649b649305
Difference Hash:0acbd181c1e70613
Wavelet Hash:00413c7dfd72f3c1
Color Hash:#864c2d

Scan History

Scan history not available

Unable to load historical scan data