Security Scan Report: aga-pics.com

Site favicon
Submitted: Completed: publiccompleted
This website contacted 16 IPs in 4 countries across 7 domains to perform 37 HTTP transactions. The main domain is aga-pics.com and was registered 13 years ago.

Submitted URL: https://aga-pics.com

AI Security Verdict

Confirmed Scam

Confidence: 90%

9
Risk Score

Legitimate-looking Kurdish institute site whose WordPress install appears compromised: ClearFake-tagged domain, EtherHiding blockchain payload resolver and obfuscated scripts hiding malware-tagged hosts.

Risk Factors (5)
Content-malware threat-intel match on the primary domain (ClearFake)
Blockchain-based payload resolver (ETHERHIDING) embedded in page scripts
Obfuscated script concealing malware-tagged hosts from the page source
Page loads resources from a domain reported as a stealer by two feeds
Multiple eval()/Function() code-generation calls consistent with an injected loader
Domain age information unavailable

Details

Page Title

پەیمانگەى (ئاگا)ى ناحکومى بۆ زانستەکانى کۆمپیوتەر – Aga Non-Government institute for computer science

Scan Type

public

Domain Name Analysis

The domain name 'aga-pics.com' uses the commercial generic top-level domain (.com) while skipping any subdomain. Its registrable label 'aga-pics' stretches across 8 characters split between 3 vowels and four consonants; it also includes one hyphen. It segments into three words: aga, pic, s. Median word length is 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

vin 2494235 siSaiutilj 52 resSol 5(Sb) sSilae, ‘Aga Non-Government institute for computer science Gojaw oylyod saiogia IRP |, 8 5 Sloe nbB5 (538) wil 09a» Sadli igsz0sip0 ee wiry Lulan & osbaw po...

Page Load Overview

75.16s
Total Load Time
522 KB
Total Size

Language Analysis

Primary Language

🇸🇦Arabic
Code: ar
Confidence:60%
Script:Arabic
Direction:rtl

Detection Details

HTML Lang Attribute:ckb
Text Length:6,304 chars
Detector Agreement:67%
Language mismatch: Declared as ckb but detected as ar

Website Classification

Primary Category

social media network95% confidence
Type: spa
Method: ml+structural

All Detected Categories

social media network
95%
adult content
71%
education learning
67%
technology software
39%
news media journalism
31%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
7143.95.235.24Ashburn, Virginia, United States
AS46606Unified Layer
2183.60.255.94China
AS4134Chinanet
2142.250.154.95Google · CDNUnited States
AS15169Google LLC
243.169.95.124Singapore
215.197.198.189Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
235.71.129.99Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
2172.66.146.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
23.33.196.84Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
2104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
215.197.152.159Aws · CLOUDUnited States
AS16509Amazon.com, Inc.
3716--

Detected Technologies7

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T12C143CE52709C43609B773E57C51B724D5AA4A23CF6D8082B1AE321857E7B9F82931CF

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:QtVyVndsmi3YoDf4q3aMEF75AcqZg69nsze+RrSnIZRwLZBD:QtVyVndF6ara

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:198291:CKA4gkQCjkMgjg8AgiRGlmB+QEABGgCgsDIjEQNIMsxnwAESEC1pJDKqmI4UgGZkDAklsECMRJBoc4SJAB2DUJgeQoRBhaj1

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ff83dbe7e7ffe7e7
Perceptual Hash:b34c8c9cb3c6cc63
Difference Hash:480e33cd4ddc8d4d
Wavelet Hash:be80f8c2c6c6c6e6
Color Hash:07201010040

Scan History

Scan history not available

Unable to load historical scan data