Security Report: yenimahallepirsultan.org.tr - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/46479641-6553-4a30-98e9-02b6fc3269c6 Domain and IP registration (RDAP)/api/v1/rdap/46479641-6553-4a30-98e9-02b6fc3269c6How often this domain was scanned/api/v1/domain/stats/yenimahallepirsultan.org.tr Scan history for this domain/api/v1/domain/history/yenimahallepirsultan.org.tr?limit=15

This website contacted 6 IPs in 3 countries across 7 domains to perform 26 HTTP transactions. The main domain is yenimahallepirsultan.org.tr and was registered 12 years ago.

Submitted URL: https://yenimahallepirsultan.org.tr

Effective URL:

https://www.yenimahallepirsultan.org.tr/

Redirected

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Compromised legitimate association site serving a ClearFake/ClickFix blockchain loader (EtherHiding via Polygon RPC); critical YARA kit matches and IDS malware alerts — do not visit; page can push a fake verification overlay leading to Terminal command execution.

Risk Factors (5)

Analyst-vetted ClearFake / ClickFix blockchain-loader kit injected into the page

EtherHiding: payload address fetched from a Polygon smart contract via public RPC endpoints

Obfuscated script hiding known-attacker hosts (1rpc.io, tenderly, drpc.org) that resolve only after decoding

CRITICAL IDS alerts for malware EtherHiding exfiltration (x2)

Scanned domain itself flagged as a malware loader in threat intelligence; page is a compromised legitimate association site (Turkish Pir Sultan Abdal culture association) now serving a fake 'Human Verification' overlay that instructs Windows users to open Terminal and run commands

Domain age information unavailable

Details

Page Title

PİR SULTAN ABDAL KÜLTÜR DERNEĞİ – YENİMAHALLE ŞUBESİ

Scan Type

public

Favicon Hash

MMH3: -1026110475

MD5: 4383d2ffae9b7a276d378e49bde1d17c

Domain Name Analysis

Domain 'yenimahallepirsultan.org.tr' uses the Turkish country-code top-level domain (.org.tr) while skipping any subdomain. The second-level label 'yenimahallepirsultan' is 20 characters long with eight vowels and 12 consonants. Splitting it apart reveals five words: yeni, mahal, le, pir, sultan. Expect four characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

3.03s

Total Load Time

306 KB

Total Size

Language Analysis

Primary Language

🇹🇷Turkish

Code: tr

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:tr

Text Length:697 chars

Detector Agreement:50%

Website Classification

Primary Category

e-commerce shopping77% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

e-commerce shopping

77%

education learning

62%

news media journalism

53%

entertainment media

45%

adult content

41%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
6	192.185.144.192	Ashburn, Virginia, United States	AS31898Oracle Corporation
4	142.250.154.95Google · CDN	United States	AS15169Google LLC
4	192.178.183.94Google · CDN	United States	AS15169Google LLC
4	35.214.244.104Google · CDN	Groningen, Groningen, Netherlands	AS15169Google LLC
4	35.227.193.242Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
4	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
26	6	-	-