ScanMalware.com

Security Scan Report: zeynelozyasar.com

Site favicon
Submitted: Sep 13, 2026, 10:47:36 AMCompleted: Sep 13, 2026, 10:49:51 AMpubliccompleted

Summary

This website contacted 27 IPs in 3 countries across 18 domains to perform 3 HTTP transactions. The main domain is zeynelozyasar.com and was registered 21 years ago.

Submitted URL: https://zeynelozyasar.com

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

Compromised WordPress coffee blog now serving an EtherHiding/ClickFix malware loader: critical IDS alerts, blockchain RPC C2 links, and fake-CAPTCHA PowerShell instructions. Avoid.

Risk Factors
Critical malware IDS alerts (EtherHiding exfiltration)
Blockchain-based payload/hosting infrastructure
Fake CAPTCHA instructing PowerShell paste-and-run (ClickFix)
Primary domain flagged as malware family in threat intel
6 cross-domain redirects
Domain age information unavailable

Details

Page Title

Zeynel – Kişisel Blog

Scan Type

public

Language

🇹🇷

Turkish

(80% confidence)

Category

blog personal website

(99%)

Domain Information

Within the commercial generic top-level domain (.com), 'zeynelozyasar.com' is registered without a subdomain. The core label 'zeynelozyasar' covers 13 characters holding five vowels versus eight consonants. Segmentation suggests five words: ze, yn, elo, zy, asar. Expect 2 characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://zeynelozyasar.com

Page Load Overview

90.53s
Total Load Time
80
HTTP Requests
18
Domains
1.7 MB
Total Size

Language Analysis

Primary Language

🇹🇷Turkish
Code: tr
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

Language Code:tr
Detection Confidence:80%
Script Type:Latin
HTML Lang Attribute:tr
Text Length:4,263 chars
Detector Agreement:75%

Website Classification

Primary Category

blog personal website99% confidence
Type: webapp
Method: ml+structural

All Detected Categories

blog personal website
99%
documentation technical
61%
news/blog
20%

Detected Features

Articles

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
28142.251.14.97Google · CDNUnited States
AS15169Google LLC
237.77.28.35Turkey
AS12735TurkNet Iletisim Hizmetleri A.S.
2142.251.20.155Google · CDNUnited States
AS15169Google LLC
2142.251.110.95Google · CDNUnited States
AS15169Google LLC
287.250.250.119Yandex · CLOUDRussia
AS13238YANDEX LLC
234.111.175.102Google · CDNKansas City, Missouri, United States
AS396982Google LLC
287.250.251.119Yandex · CLOUDRussia
AS13238YANDEX LLC
23.33.196.84Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
215.197.198.189Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
23.33.155.121Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
8027--

Page Statistics

80
Requests
18
Unique Domains
2.3 MB
Total Size

Detected Technologies4

WordPressv5.6.19
100%
MetaGenerator
100%
PHP
50%
MySQL
50%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A0B193732C98D80A55A148E2F02F7B0DE417589F53898D72D8C8E43975F9EE6C0A398D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

48:toy/irI7/F/oskfCSpzbO3EKcVKHIz6bUI2UIjHE5aw0ftS6/ZKd5VRIvpJ+kkko:DA/RRO3EnVM26ms0ftTifiZtaK3c1V35

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:5439:ECAbAYEipCIQEQACEAAAAQABAEgEYAVoAiIAsOH49gAwWJgSkJIAAwCACEg0AABAEcgahgAkAmAANgIEYYBFICAAACAAACIA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:d87e611169311179
Perceptual Hash:ca50d13e193ee731
Difference Hash:b0e4c561d1e161d1
Wavelet Hash:d87e733179310179
Color Hash:#2dd298

Other Hashes

Crop Resistant:b0e4d561d1e161d3

Scan History

Scan history not available

Unable to load historical scan data