Security Scan: https://photo.com.tr

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/4b2cef4d-bf89-44dc-8fd6-0191b6b0fb37 Domain and IP registration (RDAP)/api/v1/rdap/4b2cef4d-bf89-44dc-8fd6-0191b6b0fb37How often this domain was scanned/api/v1/domain/stats/photo.com.tr Scan history for this domain/api/v1/domain/history/photo.com.tr?limit=15

This website contacted 5 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main domain is photo.com.tr and was registered 6 years ago.

Submitted URL: https://photo.com.tr

AI Security Verdict

Confirmed Scam

Confidence: 96%

Risk Score

Confirmed ClickFix attack: compromised photo.com.tr serves a fake Cloudflare 'Human Verification' overlay that tricks Windows users into pasting attacker commands into Terminal; CRITICAL EtherHiding malware IDS/YARA hits. Do not interact.

Risk Factors (6)

Injected fake Cloudflare 'Human Verification' overlay impersonating Cloudflare on a non-Cloudflare domain (photo.com.tr)

Instructions direct Windows users to open a terminal and paste attacker-supplied commands (ClickFix execution lure)

CRITICAL IDS alert: ET MALWARE EtherHiding Exfil M2 — blockchain-based exfiltration/malware delivery

Page scripts contact blockchain RPC node rpc-mainnet.matic.quiknode.pro (EtherHiding pattern)

Threat-intelligence match on the scanned primary domain as a malware loader

Domain is compromised/repurposed: no forms or legitimate content, only a verification-gate overlay

Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Favicon Hash

MMH3: -327281452

MD5: 2a6c21667a44e7d7424eabfcf1aad3b0

Domain Name Analysis

Domain 'photo.com.tr' uses the Turkish country-code top-level domain (.com.tr) with no subdomain. Count 5 characters in 'photo' split between 2 vowels and 3 consonants. Tokenizing the label suggests one word: photo. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

1.28s

Total Load Time

45 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:50%

Script:Latin

Direction:ltr

Detection Details

Text Length:643 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software48% confidence

Type: dynamic

Method: ml+structural

All Detected Categories

technology software

48%

cryptocurrency blockchain

46%

documentation technical

30%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
3	172.67.213.248Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	132.145.155.63Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
1	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
1	104.21.23.223Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	150.136.141.142Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
7	5	-	-