Security Scan Report: frpdanismanlik.com

Site favicon
Submitted: Completed: publiccompleted
This website contacted 33 IPs in 2 countries across 18 domains to perform 244 HTTP transactions. The main domain is frpdanismanlik.com and was registered 6 years ago.

Submitted URL: https://frpdanismanlik.com

AI Security Verdict

Confirmed Scam

Confidence: 95%

10
Risk Score

Turkish consultancy page is fronted by a fake Cloudflare 'verification' that tells users to paste a command into Terminal. Primary domain and loaded resources are flagged malware, with a CRITICAL EtherHiding C2 IDS alert — do not interact.

Risk Factors (5)
Fake Cloudflare 'Human Verification' interstitial instructing the user to open Terminal and paste a command (social-engineering / ClickFix malware delivery)
Primary domain flagged as malware ('clearfake') by multiple corroborating feeds
CRITICAL IDS malware alert for EtherHiding exfiltration
Page loads sub-resources from a flagged malicious domain (checkyoubrowse.codes) and a flagged exploit-kit IP (178.16.52.101)
Blockchain RPC / Ethereum contract traffic observed in network alerts (typical of blockchain-hosted malware C2)
Domain age information unavailable

Details

Page Title

FRP DANIŞMANLIK HİZMETLERİ

Scan Type

public

Domain Name Analysis

The domain name 'frpdanismanlik.com' uses the commercial generic top-level domain (.com). Count 14 characters in 'frpdanismanlik' holding 4 vowels versus ten consonants. Segmentation suggests 6 words: frp, dan, is, man, li, k. Median word length is 2.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://frpdanismanlik.com

Page Load Overview

19.30s
Total Load Time
6.7 MB
Total Size

Language Analysis

Primary Language

🇹🇷Turkish
Code: tr
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:tr
Text Length:2,413 chars
Detector Agreement:80%

Website Classification

Primary Category

documentation technical98% confidence
Type: spa
Method: ml+structural

All Detected Categories

documentation technical
98%
corporate business
58%
government public service
37%
corporate
35%

Detected Features

Search
Articles
Schema.org

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
20172.67.152.35Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7142.251.14.101Google · CDNUnited States
AS15169Google LLC
7142.251.20.95Google · CDNUnited States
AS15169Google LLC
7146.75.120.176Fastly · CDNFrankfurt am Main, Hesse, Germany
AS54113Fastly, Inc.
7142.250.154.95Google · CDNUnited States
AS15169Google LLC
7142.251.14.94Google · CDNUnited States
AS15169Google LLC
7142.251.110.97Google · CDNUnited States
AS15169Google LLC
7142.251.13.138Google · CDNUnited States
AS15169Google LLC
7104.20.24.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
7104.21.64.153Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
24433--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1C762853B3C1E9E1952601A82E1EB7D0DE0A584A7D7A8DDBAFCFD502C63F4DD4260690D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:W6YxKyPGji9N3RlXK3o1vq9s01TAIMewsR0U4C2903GSiK4A4t:W6YsyPTN3Rlgow+MH0U4C2903GSiVAA

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:14525:Z9lMJhsRIAxeIMNwEESIQibIIGB4GkAxkgD4bxgUMEqhURyqINSAA3QAE0JEFWndAhAABENa5MSCikwUBgAIvmC28SiNECRN

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0101010101010101
Perceptual Hash:aa5555aaaa5555aa
Difference Hash:0101010101010101
Wavelet Hash:0f0f3f3f3b330101
Color Hash:#862d67

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data