Security Report: easystudytr.net - Analysis

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/a81b8ba8-e7c3-432f-baf0-225e8b9fd625 Domain and IP registration (RDAP)/api/v1/rdap/a81b8ba8-e7c3-432f-baf0-225e8b9fd625 Certificate Transparency/api/v1/ct/easystudytr.net How often this domain was scanned/api/v1/domain/stats/easystudytr.net Scan history for this domain/api/v1/domain/history/easystudytr.net?limit=15

This website contacted 28 IPs in 2 countries across 21 domains to perform 170 HTTP transactions. The main domain is easystudytr.net and was registered 14 years ago.

Submitted URL: https://easystudytr.net/

AI Security Verdict

High Risk

Confidence: 88%

Risk Score

Legitimate Turkish study-abroad consultancy whose WordPress site appears compromised: an ErrTraffic/Exvicy loader (YARA) and EtherHiding C2 exfiltration (CRITICAL IDS) are injected. Do not interact until cleaned.

Risk Factors (4)

Injected WordPress loader identified by analyst-vetted YARA rule (ErrTraffic/Exvicy, family exvicy-errtraffic-2026-09)

Critical EtherHiding exfiltration IDS alerts tied to live blockchain RPC calls made by page scripts

Obfuscated Base64 payload decoded and run through new Function() (anti-analysis code generation)

Site appears compromised — legitimate 'Easy Study' consultancy content co-hosted with malicious loader

Domain age information unavailable

Details

Page Title

Easy Study - Easy Study

Scan Type

public

Favicon Hash

MMH3: 372242042

MD5: 801cc62cff421654d1f9f5fe9f12840c

Domain Name Analysis

Domain 'easystudytr.net' uses the network infrastructure generic top-level domain (.net) without a subdomain. The registrable portion 'easystudytr' spans 11 characters holding 3 vowels versus eight consonants. Segmentation suggests 3 words: easy, study, tr. Median word length is 4 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

35.93s

Total Load Time

3.5 MB

Total Size

Language Analysis

Primary Language

🇸🇦Arabic

Code: ar

Confidence:80%

Script:Arabic

Direction:rtl

Detection Details

HTML Lang Attribute:ar

Text Length:13,476 chars

Detector Agreement:80%

Website Classification

Primary Category

healthcare medical83% confidence

Type: spa

Method: ml+structural

All Detected Categories

healthcare medical

83%

education learning

78%

documentation technical

66%

education

35%

corporate

35%

Detected Features

Articles

OG: website

Schema.org

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
8	167.172.179.80	Frankfurt am Main, Hesse, Germany	AS14061DigitalOcean, LLC
6	142.251.20.97Google · CDN	United States	AS15169Google LLC
6	104.17.208.5Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	142.251.127.84Google · CDN	United States	AS15169Google LLC
6	132.145.155.63Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
6	157.240.0.6Facebook · CDN	Frankfurt am Main, Hesse, Germany	AS32934Facebook, Inc.
6	178.16.52.101	Frankfurt am Main, Hesse, Germany	AS202412Omegatech LTD
6	104.20.38.203Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
6	34.117.59.81Google · CDN	Kansas City, Missouri, United States	AS396982Google LLC
6	104.20.46.180Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
170	28	-	-