ScanMalware.com

Security Scan Report: ozbilen.web.tr

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/a1450aef-2ee2-460a-ae00-e85144458bb1Domain and IP registration (RDAP)/api/v1/rdap/a1450aef-2ee2-460a-ae00-e85144458bb1How often this domain was scanned/api/v1/domain/stats/ozbilen.web.trScan history for this domain/api/v1/domain/history/ozbilen.web.tr?limit=15
This website contacted 12 IPs in 3 countries across 10 domains to perform 202 HTTP transactions. The main domain is ozbilen.web.tr and was registered 23 years ago.

Submitted URL: https://ozbilen.web.tr

AI Security Verdict

Confirmed Scam

Confidence: 93%

9
Risk Score

Compromised WordPress site serving a ClickFix fake CAPTCHA that tells visitors to paste a command into Windows Terminal, with CRITICAL EtherHiding/ClickFix IDS alerts and malware-flagged domain.

Risk Factors (5)
ClickFix fake CAPTCHA / 'connection security review' instructing terminal command paste
CRITICAL IDS malware alerts (EtherHiding exfiltration, ClickFix domain)
Content-malware threat-intel match on the primary domain corroborated by two feeds
Blockchain RPC connections consistent with EtherHiding payload retrieval
Malicious third-party resource hosts loaded by the page
Domain age information unavailable

Details

Page Title

Ozbilens | Bir başka WordPress sitesi

Scan Type

public

Domain Name Analysis

Domain 'ozbilen.web.tr' uses the Turkish country-code top-level domain (.web.tr) without a subdomain. Its registrable label 'ozbilen' stretches across 7 characters holding three vowels versus four consonants. Word splitting yields 3 words: oz, bile, n. Expect two characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://ozbilen.web.tr

Page Load Overview

9.71s
Total Load Time
2.7 MB
Total Size

Language Analysis

Primary Language

🇹🇷Turkish
Code: tr
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:tr
Text Length:6,911 chars
Detector Agreement:50%

Website Classification

Primary Category

adult content53% confidence
Type: spa
Method: ml+structural

All Detected Categories

adult content
53%
e-commerce shopping
44%
blog personal website
44%
healthcare medical
41%
documentation technical
39%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
26149.13.62.221Istanbul, Istanbul, Turkey
AS199724TeknoDC Bilisim Teknolojileri A.S.
16104.26.5.88Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1635.227.193.242Google · CDNKansas City, Missouri, United States
AS396982Google LLC
16178.16.52.101Frankfurt am Main, Hesse, Germany
AS202412Omegatech LTD
16142.251.110.95Google · CDNUnited States
AS15169Google LLC
16142.251.110.94Google · CDNUnited States
AS15169Google LLC
16172.67.191.179Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
16104.20.38.203Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
16152.236.9.75Frankfurt am Main, Hesse, Germany
AS396356Latitude.sh
16172.66.150.162Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
20212--

Detected Technologies10

WordPressv6.6.10
100%
MetaGenerator
100%
JQueryv3.7.1
100%
PHP
50%
MySQL
50%
LiteSpeed
40%
HTTP/3
40%
prettyPhoto
20%
WooCommerce
20%
Slider Revolution
20%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T15D462353831B162ED1950962D248352BA0C3DE2B19AD61BE7BE33EE5FC7E294C0F9711

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:xKck9oIikIUkfkoIkp5ktptzVTwvdcJz5AOOGBTnvQ27jjOY+e65RJsbbh7WkIvX:veI82wpZRcdcJz5AOOGBTnvQ2N+eCrH

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:5753060:YWAJyEoueQy7AyE0hOAB5BkDDIA1JBCELRwgrRCgACiIDIgSAAT1RAwAYBMEQUmCI0wmCAdGQkbAEpAUXXAYdgEAYAAhGWgx

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:70ffffffffffffff
Perceptual Hash:ea4d4d4d4d4d4555
Difference Hash:8000000000000000
Wavelet Hash:404d0f0f0f0f0f0f
Color Hash:#99ac53

Other Hashes

Crop Resistant:8000000000000000

Scan History

Scan history not available

Unable to load historical scan data